[DigitalToday reporter Chi-gyu Hwang (황치규)] Microsoft has again asked administrators of its cloud-based account and login management service Entra ID to change user authentication methods to passkeys, BleepingComputer reported on Oct. 28 local time.

Microsoft will end SMS and voice authentication in February 2027.

According to the report, Microsoft said in a Microsoft 365 Message Center notice on Oct. 27, "Starting Feb. 1, 2027, Microsoft will end the SMS and voice authentication it provides," adding, "To avoid login disruptions, you must complete the transition before then."

The shutdown applies only to Entra ID for corporate employees. It does not include Azure AD B2C, a customer identity management service, and Entra External ID.

After the change, users will not be able to log into their accounts with MFA via SMS or voice. Administrators must move users to phishing-resistant methods such as passkeys, QR code authentication and FIDO2 security keys.

Microsoft recommended passkeys, saying, "SMS and voice authentication are vulnerable to phishing and SIM swapping attacks." Companies that must continue using phone-based authentication must directly connect an external carrier through the Microsoft Security Store.

Microsoft has been switching the default authentication method for Entra ID to passkeys since September. In August, it also halted a feature that allowed free Entra ID customers to use SMS as a primary login method, citing risks of phishing, fraud and account takeovers.