MC1550537 - Prepare custom authentication strengths for SMS and voice retirement

Microsoft 365 Message Center announcement MC1550537.

MS Message Center's Summary

Microsoft is retiring voice and text message authentication in Microsoft Entra ID. Tenants must review custom authentication strengths used in Conditional Access policies to ensure they permit passkeys before the phased rollout begins in early 2027. Administrators need to update policies that currently allow text or voice but exclude passkeys to prevent user sign in blocks.

Administrator impact
Administrators must review custom authentication strengths and update them to include passkeys before the rollout reaches the tenant.
End user impact
Users relying on text message or voice authentication will need to register a passkey to sign in when the change takes effect.
Importance
8/10: Failure to update custom authentication strengths before the retirement date will block affected users from signing in.

SMS and voice retirement and migration guidance

Overview of Conditional Access authentication strengths

Message Center ID
MC1550537
Category
plan For Change
Severity
normal
Services
Microsoft Entra
Tags
User impact, Admin impact, Retirement
Published
2026-11-12
Last updated
2026-11-12
Expires
2027-03-01
Action required by
2027-02-01

[What and why] You're receiving this message because we detected one or more custom authentication strengths in your tenant that allow SMS and/or voice but don't allow passkeys (FIDO2). As part of the retirement of Microsoft-provided SMS and voice authentication in Microsoft Entra ID, users will no longer be able to use these methods to sign in. Affected users will be allowed to register a passkey to regain access. However, if a Conditional Access policy requires a custom authentication strength that doesn't allow passkeys (FIDO2), registering a passkey won't resolve the sign-in block. Review the affected custom authentication strengths and add passkeys (FIDO2) as an allowed method before retirement reaches your tenant. This helps prevent users who rely on SMS or voice from being blocked without a self-service remediation path. [Rollout schedule] User population Sign-in retirement rollout begins Complete preparation Users other than Global Administrators and external users February 1, 2027 Before the applicable rollout reaches your tenant Global Administrators and external users July 1, 2027 Before this separate rollout reaches your tenant These are phased rollout start dates, not a single cutoff for every organization. Affected users can be blocked when the applicable rollout reaches your tenant. Important: Microsoft can't provide each tenant with the specific date the retirement behavior will reach it. Prepare your organization before February 1, 2027 , even if the rollout reaches your tenant later. Don't wait for a tenant-specific rollout date before taking action. The separate rollout for Global Administrators and external users begins July 1, 2027, as shown above. [Impact on your organization] Who is affected Users who rely on Microsoft-provided SMS or voice and are subject to a Conditional Access policy that requires a custom authentication strength allowing SMS and/or voice but not passkeys (FIDO2) are affected. Detection of an affected custom authentication strength doesn't mean every user in your organization will be blocked. Review the Conditional Access policies that use it and the users included in those policies to determine your impact. Platforms and services Microsoft Entra ID sign-in Microsoft Entra Conditional Access policies that require a custom authentication strength What will happen When the applicable sign-in retirement rollout reaches your tenant: Users can no longer use Microsoft-provided SMS or voice to sign in. Affected users will be allowed to register a passkey to regain access. If the required custom authentication strength doesn't allow passkeys (FIDO2), the passkey won't satisfy that policy. Users who don't have another available method that meets the policy will remain blocked and need administrator assistance. Required custom authentication strength Effect on the passkey remediation path Allows passkeys (FIDO2) The authentication strength permits users to sign in with a passkey, subject to other applicable policies and requirements. Doesn't allow passkeys (FIDO2) Registering a passkey won't satisfy the authentication strength. Users without another available, permitted method remain blocked. [Action required and recommendations] Identify affected custom authentication strengths Review your custom authentication strengths in the Microsoft Entra admin center. Identify any that allow SMS and/or voice but don't allow passkeys (FIDO2). For each affected strength, identify the Conditional Access policies that require it and review their user and resource scope. Allow passkeys (FIDO2) In the Microsoft Entra admin center , go to Entra ID > Authentication methods > Authentication strengths . Select each affected custom authentication strength, add passkeys (FIDO2) as an allowed method, and save your changes. Registering a passkey isn't enough if the required authentication strength still excludes it. Update the strength before users need the retirement remediation experience. Test and communicate Test with representative users covered by the affected policies. Verify that users can register a passkey and use it to sign in to protected resources under your applicable policies. Notify affected users and your helpdesk about the retirement, passkey registration steps, and the support path if users can't complete registration or sign-in. Learn more SMS and voice retirement and migration guidance Overview of Conditional Access authentication strengths [Compliance considerations] Review changes to custom authentication strengths against your organization's security and compliance requirements. Validate that the passkeys you permit meet those requirements and work with the Conditional Access policies that protect your resources.