How to Replace SMS and Voice MFA in Microsoft Entra Before the Deadline

Microsoft is retiring SMS and voice MFA for Entra ID. If you have users on phone-based authentication, you need a migration plan. This guide covers what is changing, what alternatives Entra gives you, and how to move users over before the cutoff.

Why Microsoft Is Retiring SMS and Voice MFA

SMS and voice authentication rely on phone networks, which are not secure. SIM swap attacks, number porting, and interception are real threats. Microsoft announced it would retire these methods to push organizations toward phishing-resistant alternatives.

The current expected retirement date is in 2027 for existing tenants, though new tenant restrictions started earlier. Do not treat this as an indefinite extension. Planning early gives you time to test alternatives, budget for hardware keys if needed, and avoid a last-minute scramble that creates support tickets.

If you do not migrate before the deadline, affected users will be prompted to register a new authentication method the next time they sign in. Depending on your tenant configuration, this can temporarily block access until a new method is set up.

Your Entra MFA Alternatives Ranked

Here is what Microsoft recommends instead of SMS and voice MFA, roughly ordered by security level.

Microsoft Authenticator app (push notification) is the closest drop-in replacement for most users. It uses push notifications rather than one-time codes, which are harder to phish. Users need a smartphone with the Authenticator app installed. Registration takes about two minutes per user.

Hardware security keys (FIDO2/WebAuthn) are the strongest option. They are immune to phishing and require no phone or network connection. YubiKey and other FIDO2 keys plug into USB-A or USB-C ports. The tradeoff is procurement cost and logistics for distributed users.

Windows Hello for Business works well for organizations with managed Windows devices. It uses biometrics or a PIN tied to the device hardware and is phishing-resistant by design. It requires Windows 10 or later and proper hybrid Entra join configuration.

Third-party TOTP authenticator apps (Google Authenticator, Authy, Aegis) generate one-time codes locally. More secure than SMS but still vulnerable to real-time phishing tools that relay codes in transit. Use them when Microsoft Authenticator cannot be deployed for policy reasons.

Passkeys (FIDO2) are the emerging standard. They bind authentication to a specific website or service and cannot be phished or reused across domains. Browser and platform support is growing but varies.

How to Migrate Users Who Cannot Use Phones or Hardware Keys

This is the question that comes up most in sysadmin communities. Organizations often have users who cannot use smartphones (shared devices, BYOD restrictions, international logistics) or hardware keys (budget, procurement timelines). Here is what works.

Windows Hello for Business on managed endpoints is the most practical phone-free option for most organizations. If your users have Windows 10 or 11 devices joined to Entra ID, you can enable Windows Hello through Group Policy or Intune. No additional hardware is required and users already have a PIN or biometric they know. The catch: it only works on enrolled devices, so users with multiple machines need a backup method.

Certificate-based authentication in Entra uses client certificates instead of phone-based second factors. This requires Entra ID P1 or P2 and a certificate authority. Setup complexity is high but the security properties are strong and it works well for managed device scenarios.

Conditional Access policies with a phased grace period let you migrate gradually. Create a policy that warns users who have not migrated, then later blocks SMS/voice attempts. This gives you time to support users who need extra help without locking anyone out immediately.

Deploying FIDO2 keys at scale is more practical than it sounds. Entry-level YubiKeys cost around $20 to $50 each. For 50 or more users who genuinely cannot use phones, the per-key cost compares favorably to the helpdesk expense of recovering locked-out accounts. Plan six to eight weeks for procurement and distribution.

The specific path depends on your user base. Start by running a report to see how many users are still on phone authentication, then prioritize the phone-free group and users who need the most support.

Step-by-Step: Changing the Authentication Method in Entra

Find users still on SMS or voice MFA

Open the Entra admin center and go to Identity > Users > All users. Filter by Authentication Methods. Export the list of users with phone methods registered. Alternatively, use the Microsoft Graph API:

GET /beta/reports/authenticationMethods/userRegistrationDetails

Look for users where the phone method is registered and Authenticator is not.

Enable Microsoft Authenticator for your tenant

In the Entra admin center, go to Security > Authentication methods > Microsoft Authenticator. Set the method to Enabled and select which user groups can use it. Start with a pilot group, then expand.

Push Authenticator registration via Conditional Access

Create a Conditional Access policy targeting users who still have phone methods:

• Users: select the group with phone-MFA users
• Target resources: any cloud app or your priority apps
• Grant controls: require registration with Authenticator app

This forces registration on next sign-in without blocking access immediately.

Audit before the deadline

Before the cutoff, run a sign-in log query in Entra for failed MFA attempts using phone methods. Users who cannot authenticate will generate errors you can catch and resolve proactively rather than reactively.

Managing the Deadline: Conditional Access as Your Safety Net

Conditional Access gives you a layered migration approach.

Layer 1: Notify. Create a policy that grants access normally but shows a custom text warning to users still on SMS/voice. This tells you who has not migrated without disrupting work.

Layer 2: Block with exception window. After the warning phase, create a policy that blocks authentication methods you want to retire but creates an exception for specific users who need more time. Document the exception list and set a review date.

Layer 3: Full enforcement. When all migratable users are over, block SMS and voice at the Conditional Access level. No user can accidentally fall back to an unsupported method.

Review your exception list monthly. Users who requested extra time due to device constraints may now have different circumstances.

Frequently Asked Questions

When exactly is Microsoft retiring SMS and voice MFA?

Microsoft's current timeline targets full retirement of SMS and voice as MFA options for existing tenants in 2027. Check the Microsoft Entra updates page for the most current dates, as these have shifted before.

Can I keep SMS MFA if I am in a regulated industry?

In most cases, Authenticator app or hardware keys meet or exceed the security bar of SMS. If you believe you have a legitimate exemption need, contact Microsoft support with your tenant ID and use case.

What if my users only have feature phones, not smartphones?

Feature phones cannot run Authenticator. For these users, hardware FIDO2 keys are the most practical long-term option. As a short-term bridge, contact Microsoft support to document an exception while you procure keys.

Does the Authenticator app work offline?

Yes. Authenticator generates codes locally using the TOTP algorithm. No internet or cellular connection is required for the code itself. Push notifications require data or WiFi, but the app falls back to displaying a code if the network is unavailable.

Can I use third-party TOTP apps instead of Microsoft Authenticator?

Yes, Entra ID supports RFC 6238 TOTP, which means Google Authenticator, Authy, Aegis, and other compatible apps work. However, only Microsoft Authenticator supports passwordless phone sign-in, which is Microsoft's preferred target for this migration.

How long does a typical migration take for 100 users?

Four to six weeks is realistic. Week one covers planning and pilot selection. Weeks two and three handle Authenticator registration for the majority. Weeks four and five address edge cases: users without smartphones, shared devices, and international offices. Week six is deadline enforcement and cleanup.

What happens to users who do not migrate before the deadline?

If Conditional Access is configured to block SMS/voice and the user has no registered backup method, they will be prompted to register a new authentication method on next sign-in. If no other method is configured, they may be temporarily blocked. An admin can reset the user's authentication methods to restore access.

While You Are Hardening Authentication, Check Your Email Domains

Strong MFA is one part of your security posture. Your email sending domains are another attack surface. DMARC monitoring catches spoofing attempts on domains you control, even when MFA is solid. Attackers can still impersonate your domain in email to phishing targets outside your organization.

DMARCFlow parses your aggregate reports and alerts you when new sending sources appear or when legitimate mail starts failing authentication. If you are already working through an Entra MFA migration, adding DMARC monitoring is a logical next step for your domain security.

---

If this helped you plan a migration, share it with a colleague working through the same problem.