M365 Entra ID | Microsoft to Disable SMS and Voice MFA

Microsoft is discontinuing its own delivery of SMS and voice calls for MFA in Entra ID. Organizations that still require phone-based methods will need to select an external telephony provider in the future.

According to Message Center MC1519855, the option "Choose Your Own Telephony Provider" (CYOT) will be generally available worldwide on October 30, 2026.

Users whose only available MFA method is SMS or voice must register a passkey at login after the respective deadline. The prompt blocks the login until a telephony provider is configured and cannot be disabled. Those who already have a passkey, Windows Hello for Business, or another phishing-resistant method are unaffected.

A temporary opt-out from September 1, 2026, to February 1, 2027, only delays the automatic passkey activation and registration campaign, not enforcement. It is managed via the Graph property `optOutSettings.passkeyDynamicMigration` on the Authentication Methods Policy (Beta endpoint, permission `Policy.ReadWrite.AuthenticationMethod`).

First, you need the list of affected users. Microsoft provides the PowerShell script Get-SmsVoicePolicyUsers.ps1 on GitHub for this purpose. You will need the Global Reader, Authentication Policy Administrator, or Security Reader role to use it.

Next, you enable Passkey (FIDO2) as an authentication method and set up the registration campaign.

As the target, you select the security group for SMS and voice users that you created after the identification via the script. This ensures the campaign reaches exactly those users who would later be blocked, and not the entire tenant.

CYOT is only worthwhile when there is a documented need, such as for regulatory reasons or for users who cannot use a passkey. The provider selection is made via the Microsoft Security Store. Soprano and Telesign are listed in the Private Preview, with more expected to follow at general availability. Contract, configuration, and monitoring remain your responsibility.

According to the Message Center, purchasing in the Security Store requires an Azure billing subscription, a resource group, and an appropriate Azure role. Microsoft will provide menu paths and roles for configuration with the documentation on October 30th—check them yourself at that time.

The shutdown is a deadline, not a suggestion. Those who use SMS and voice calls purely out of habit should switch to passkeys and save on provider costs. SMS is also not phishing-resistant, as SIM swapping and SS7 attacks bypass the channel.

If you need phone-based MFA for business reasons, you should start planning your vendor selection and procurement now—both take longer than the technical implementation.