MC1536049 - Microsoft Entra ID: Microsoft-provided SMS and voice authentication to retire for self-service password reset (SSPR)

Microsoft 365 Message Center announcement MC1536049.

MS Message Center's Summary

Microsoft Entra ID is retiring Microsoft provided phone verification for self service password reset starting in February 2027. Each user group will have a fifty day transition period once the change reaches your tenant. Administrators must identify impacted users, provide alternative recovery options, or configure a supported telephony provider to prevent service desk disruptions.

Administrator impact
Administrators must audit user authentication methods and deploy alternative recovery options before the transition window closes.
End user impact
Users relying solely on phone verification for password resets will lose that capability and must register alternative methods.
Importance
8/10: This retirement directly affects core authentication workflows and will break password recovery for users without alternative methods.

SMS and voice retirement and migration guidance

How Microsoft Entra self service password reset works

Choose a telephony provider for SMS and voice authentication

Microsoft Summary

Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication for self-service password reset (SSPR) starting February 2027, with a 50-day transition per user group. Organizations must prepare alternative recovery methods, as SMS/voice will no longer be available for SSPR after the transition.

Message Center ID
MC1536049
Category
plan For Change
Severity
normal
Services
Microsoft Entra
Tags
User impact, Admin impact, Retirement
Published
2026-11-03
Last updated
2026-11-03
Expires
2027-03-03
Action required by
2027-03-22

[What and why] As Microsoft-provided SMS and voice authentication retire in Microsoft Entra ID, these methods will also become unavailable for SSPR. Organizations have 50 days after the applicable sign-in retirement rollout reaches their tenant to prepare alternative recovery methods. Users may still be able to sign in but lose the ability to reset forgotten passwords. Passkeys and other sign-in methods don't automatically satisfy SSPR requirements. Admins should identify affected users and ensure they have enough eligible recovery methods to prevent disruptions and increased helpdesk requests. [Rollout schedule] General Availability (Worldwide, GCC): We expect rollout to begin and complete in February 2027 User population Sign-in retirement rollout begins SSPR transition ends Users other than Global Administrators and external users February 1, 2027 50 days after this rollout reaches your tenant Global Administrators and external users July 1, 2027 50 days after this separate rollout reaches your tenant These are phased rollout start dates , not a single SSPR cutoff for every organization. Each population's 50-day period begins when its applicable rollout reaches your tenant. [Impact on your organization] Who is affected Organizations with users who rely on Microsoft-provided SMS/voice to meet their password-reset verification requirements. This includes users who have another sign-in method but still depend on SMS/voice for password recovery. Platforms and services Microsoft Entra ID SSPR What will happen When the applicable sign-in retirement rollout reaches your tenant: 50-day transition: Existing SMS and voice registrations remain usable for SSPR under your current recovery policy. Registration changes: SMS/voice SSPR registration and refresh prompts stop, but prompts for other eligible methods continue. My Sign-Ins: Users can no longer add SMS/voice methods or edit authentication phone numbers. Existing phone registrations appear disabled, even while usable for SSPR during the transition. Customer-managed telephony (CYOT): Recovery through supported providers remains available. After the 50-day transition period: Microsoft-provided SMS and voice are no longer available as SSPR recovery options. User's remaining eligible recovery methods Password-reset experience Enough methods to meet the applicable SSPR requirement User can continue resetting their password with those methods Not enough methods to meet the applicable SSPR requirement User cannot complete SSPR and is directed to contact their administrator The applicable one/two method requirement still applies. To retain SMS/voice for recovery, your organization must configure a supported CYOT. Microsoft will not automatically change your SSPR policy or enable Allow password change after secure sign-in for your tenant. [Action required and recommendations] Prepare affected users before their applicable 50-day transition period ends: Identify affected users . Find users relying on SMS/voice for SSPR, even if they have other sign-in methods registered. Use the SMS and voice retirement and migration guidance . Prepare alternative recovery methods . Ensure users have enough eligible methods to meet SSPR policy requirements without Microsoft-provided SMS/voice. Passkeys alone don't satisfy SSPR requirements. If phone recovery is needed, configure and test a supported telephony provider before the transition ends. Test and communicate . Verify password recovery works with your SSPR policies and Conditional Access settings. Inform users and helpdesk staff about deadlines, registration steps, and support options. Recommended: Let passkey users change a forgotten password Where available, administrators can enable Allow password change after secure sign-in for eligible users. Users can then sign in with their passkey and change their password in My Sign-Ins without knowing/entering their current password. Learn more SMS and voice retirement and migration guidance How Microsoft Entra self-service password reset works Choose a telephony provider for SMS and voice authentication [Compliance considerations] If your organization needs phone-based recovery for regulatory or operational reasons, plan and validate a supported customer-managed provider before the applicable SSPR cutoff.