Microsoft retires SMS and voice MFA on 1 February 2027: find the users it will block

#microsoft #powershell #sysadmin #security

Microsoft retires its own SMS and voice MFA on 1 February 2027. The users it will stop are already in your tenant, and you can list them today with one read-only command.

What changes: Microsoft-provided SMS and voice MFA retires. Users whose only MFA method is SMS or voice must register a passkey during sign-in before they can continue.
Who: all users except Global Administrators and external users. Internal guests are included.
By when: 1 February 2027. Global Administrators and external users: 1 July 2027.
Do this:
1. List the users whose only MFA method is SMS or voice.
2. Enable passkeys for them and run a registration campaign.
Check: Get-MgReportAuthenticationMethodUserRegistrationDetail (read-only)
Source: MC1519855, Microsoft Learn "SMS and voice retirement FAQ"

What Microsoft actually said

From the Microsoft Learn FAQ (last updated 23 September 2026) and Message Center post MC1519855 (21 October 2026):

From 1 February 2027 the retirement applies to all users except Global Administrators and external users. Those two groups follow on 1 July 2027.
Internal guests are not in the July group. They follow the February date.
After the date, a user whose only MFA method is SMS or voice has to register a passkey during sign-in to keep using the account. It is a blocking prompt, not a nudge.
There is no opt-out for enforcement. The temporary opt-out (passkeyDynamicMigration) only covers the changes between 1 September 2026 and 1 February 2027.
If you really need SMS or voice, you can contract a telephony provider through Microsoft Security Store. The configuration becomes available from 30 October 2026. Tenants with a provider configured keep SMS or voice under their own policies.

So the question for most tenants is not "do we keep SMS". It is "who is going to hit that prompt on a Monday morning in February".

Step 1: list the phone-only users

You need the user registration details report. It needs Entra ID P1 or P2, the AuditLog.Read.All permission and a role such as Reports Reader, Security Reader or Global Reader.

Portal route: Entra admin center > Entra ID > Authentication methods > User registration details, then filter on methods registered. Fine for a look. For a list you can work from, use Microsoft Graph PowerShell:

Connect-MgGraph -Scopes AuditLog.Read.All

$r = @(Get-MgReportAuthenticationMethodUserRegistrationDetail -All)

# Phone methods, and methods that don't count as a way out
$phone = @('mobilePhone','alternateMobilePhone','officePhone')
$weak  = @('mobilePhone','alternateMobilePhone','officePhone','email','securityQuestion')

$only = @($r | Where-Object {
    $m = @($_.MethodsRegistered)
    ($m | Where-Object { $phone -contains $_ }).Count -gt 0 -and
    ($m | Where-Object { $weak -notcontains $_ }).Count -eq 0
})

"Users in report: $($r.Count)"
"Phone-only users: $($only.Count)"
"  admins: $(@($only | Where-Object { $_.IsAdmin }).Count)"
"  guests: $(@($only | Where-Object { $_.UserType -eq 'guest' }).Count)"

$only | Select-Object UserPrincipalName, UserType, IsAdmin,
    @{n='Methods';e={$_.MethodsRegistered -join ';'}} |
    Export-Csv -NoTypeInformation -Encoding UTF8 .\phone-only-users.csv

Everything here is a Get- call. It changes nothing.

Why email and security questions are in the "weak" list: they are not MFA methods that will let a user through the prompt. A user with SMS plus email is still phone-only for this purpose. Anyone with Microsoft Authenticator, a passkey, a FIDO2 key, a software OTP or Windows Hello for Business drops out of the list.

Step 2: split the list before you plan

Three buckets, three conversations:

Admins. IsAdmin is true for any admin role, not only Global Administrator. Only Global Administrators get 1 July 2027. Everyone else with a role is on 1 February. Check the role before you relax. Break-glass accounts should be on FIDO2 keys anyway.
Guests. The report can't tell an internal guest from an external (B2B) user who signs in through another organisation. Internal guests are on the February date. Decide per account: convert to member, give it another strong method, or remove it.
Members. Usually the big number. This is where the registration campaign and the user messages go.

Step 3: check the policy side

Two more read-only looks tell you whether the tenant is ready for the move:

Connect-MgGraph -Scopes Policy.Read.All

# Where SMS and voice are switched on, and for whom
foreach ($id in 'Sms','Voice') {
    $c = Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $id
    $t = @($c.AdditionalProperties['includeTargets'] | ForEach-Object { $_['id'] }) -join ', '
    "$id : state=$($c.State); targets=$t"
}

# Is Passkey (FIDO2) enabled, and for whom
$f = Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId Fido2
"Passkey (FIDO2): state=$($f.State)"

# Registration campaign state
$rc = (Get-MgPolicyAuthenticationMethodPolicy).RegistrationEnforcement.AuthenticationMethodsRegistrationCampaign
"Registration campaign: $($rc.State)"

If Passkey (FIDO2) is disabled or doesn't target your phone-only group, that is the first change to make. Pilot it with IT staff first.

Step 4: count down, weekly

Put the phone-only users in a group, aim the passkey registration campaign at it, and re-run the export every week. The number in the tracker should only go one way. Divide what's left by the weeks remaining minus one, and you know how many users the helpdesk needs to move each week to finish a week early.

Month-end will find the finance user nobody told.

Sources

Microsoft Learn, SMS and voice retirement FAQ: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement-faq
Message Center MC1519855 (21 October 2026)
Microsoft Graph reference: "List userRegistrationDetails"

Drafted with AI assistance and checked against Microsoft Learn before publishing.

DEV Community