What Happened
Microsoft reminded Entra ID administrators on October 27 through Message Center update MC1528000 to move users off SMS and voice authentication, reports BleepingComputer. Microsoft will stop offering both methods as native Entra capabilities on February 1, 2027. The change covers workforce tenants. Azure AD B2C and Entra External ID are unaffected.
The rollout already started. SMS first-factor sign-in ended for Free tenants in August, and passkeys became the default experience in September. Users enabled for SMS or voice get a prompt to register a passkey at their next MFA challenge.
Why This Matters for Canadian Organizations
Microsoft 365 anchors identity for most Canadian businesses and public bodies. Many still rely on text message codes because they are cheap and familiar. Those codes fall to phishing kits and SIM-swap fraud, and our recent coverage of adversary-in-the-middle campaigns shows how fast attackers replay stolen sessions.
Weak authentication also carries regulatory weight. PIPEDA requires safeguards proportionate to data sensitivity, and federally regulated financial institutions answer to OSFI expectations. A forced cutover in February with no plan locks staff out. A rushed fix pushes them toward weaker workarounds.
What to Do
Run Microsoft’s Entra SMS/Voice Policy Scanner script to list affected users. Enroll them in passkeys, FIDO2 security keys, or QR code authentication before the deadline. Start with administrators and finance staff. Plan help desk support for lost devices and shared workstations. If your organization needs phone-based verification, evaluate a customer-managed telecom provider through the Microsoft Security Store. Read more in our news archive.
