How does Microsoft’s SMS retirement affect CIAM products
Microsoft has provided guidance around the retirement of Microsoft-provided SMS and voice authentication in Microsoft Entra ID.
“Beginning September 1, 2026, passkeys will be automatically enabled for users currently enabled for SMS or voice. Beginning February 1, 2027, tenants that have not configured a customer-managed telecom provider through the Microsoft Security Store will no longer be able to use SMS or voice for MFA”.
But what does this mean for Azure AD B2C and Entra External ID?
Get Rory Braybrook’s stories in your inbox
Join Medium for free to get updates from this writer.
The answer is in this FAQ:
Will Azure AD B2C or Microsoft Entra External ID tenants be impacted by this announcement?
Azure AD B2C is out of scope and isn’t affected. For Microsoft Entra External ID, this change will take effect next year, and a separate announcement will follow. So there’s no change for either Azure AD B2C or Microsoft Entra External ID tenants with this announcement.
Are external MFA methods affected by the retirement of SMS and voice?
No, only SMS and voice authentication method policies and legacy MFA policies are retired.
On September 1, 2026, users who are enabled for SMS or voice in the authentication method policies or legacy MFA policies are automatically enabled for passkeys and are nudged to register. External MFA users aren’t in scope unless they’re also enabled for SMS or voice.
All good!
