Microsoft is retiring SMS and voice authentication because they are weaker and easier to attack than modern methods. SMS can be intercepted or redirected, and voice calls are vulnerable to social engineering and telephony abuse. Organisations should migrate users to stronger alternatives, then disable these methods where policy allows and verify that recovery paths still work.
What Microsoft is changing and why that matters
SMS and voice authentication are being retired because they are legacy factors that no longer meet the security bar Microsoft wants for Entra ID sign-in and recovery. They are still convenient, but convenience is not the same as assurance. If a method can be intercepted, redirected, or socially engineered, it is a weaker trust anchor than modern phishing-resistant options, especially for accounts that protect business applications and admin workflows.
The practical implication is that this is not just a channel change. It is a shift away from factors that can be abused at the telephony layer and toward methods that bind authentication more tightly to the user, device, or cryptographic credential. That is why migration planning needs to start with the accounts and workflows that still depend on SMS or voice for everyday access or fallback recovery.
When comparing sign-in methods, organisations should treat recovery and step-up paths as part of the authentication design, not an afterthought. The weakest path often becomes the real path an attacker targets, so a method can look “retired” on paper but remain effective if it is still allowed for reset, backup verification, or exception handling.
How SMS and voice are typically abused
SMS can fail because the message itself is not a strong proof of possession. Attackers may intercept codes through SIM swap, number porting, message forwarding, or malware on the endpoint that receives the text. Voice authentication has a different weakness profile, but the result is similar: callers can be manipulated through social engineering, call forwarding abuse, voicemail abuse, or telecom weaknesses that let an attacker receive the code instead of the legitimate user.
Those weaknesses matter most when the factor is used to satisfy a second factor requirement for a high-value account. A code delivered over a phone channel may stop a trivial password guess, but it is still vulnerable to adversary-in-the-middle phishing, help desk manipulation, or abuse of the recovery process. MFA Guide covers why SMS-based MFA is easier to bypass than phishing-resistant methods and how to phase in stronger alternatives.
Microsoft’s direction aligns with the wider shift toward phishing-resistant authentication. Modern options reduce the chance that a stolen code, forwarded call, or coerced recovery step becomes a valid entry point. In practice, that means organisations should prioritise methods that resist replay and remote interception, not merely methods that are widely available to every user.
How to migrate without breaking access or recovery
The safest way to retire SMS and voice is to replace them before disabling them. Start by identifying who still uses them, then move those users to stronger sign-in methods and verify that account recovery still works after the change. This is especially important for users who travel, change devices often, or depend on fallback methods when they lose access to their primary authenticator.
Do not assume that “MFA enabled” means the environment is safe. The most common failure is leaving a weaker fallback in place after stronger methods are introduced. That is why recovery, help desk reset, and temporary access rules should be reviewed at the same time as the primary sign-in method. Passwordless and Passkeys Guide is useful here because it explains phishing-resistant rollout and the recovery choices that usually matter most during migration.
For organisations running microsoft entra id, the retirement decision should also be tested against policy scope. Some tenants will be able to disable SMS and voice broadly, while others may need a staged exception period for business continuity. The key question is whether the exception is temporary, visible, and reviewed, or whether it quietly becomes a permanent weak point.
Risk and Threat Considerations
SMS and voice factors create an exposure window because they rely on channels that are outside the cryptographic and device-bound controls used by stronger authenticators. That makes them attractive for phishing, telecom abuse, and social engineering, particularly where the attacker only needs one successful redirection of a code or call.
Failure mechanism: An attacker diverts the phone-based factor through SIM swap, call forwarding, voicemail takeover, or help desk manipulation, then uses the recovered code or reset path to satisfy authentication.
Impact: The attacker can complete sign-in, reset access, or move into recovery workflows that were assumed to be protected, which can lead to account takeover and wider tenant compromise if the affected identity has elevated access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Authenticator Assurance Levels and phishing-resistant authentication | Phone-based factors are weaker than modern digital identity authenticators. |
| Recommendation — Prefer phishing-resistant authenticators and reduce reliance on SMS or voice factors. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Retiring weak factors requires controlled lifecycle management of authenticators and recovery paths. |
| IA-2 — Identification and Authentication (Organizational Users) | Entra ID sign-in retirement affects how organizational users authenticate. | |
| Recommendation — Manage authenticator lifecycle and remove weaker methods from active use. Enforce stronger user authentication methods for workforce access. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | The change is an access-control decision about acceptable authentication methods. |
| A.8.5 — Secure authentication | SMS and voice retirement is driven by the need for stronger authentication assurance. | |
| Recommendation — Define and enforce approved authentication methods in access policy. Require stronger authentication mechanisms than phone-delivered codes or calls. | ||
Practitioner Guidance
What to prioritise: Replace SMS and voice first for privileged users, support staff, and any account that can reach sensitive business systems. Those accounts create the largest blast radius if the fallback path is abused.
What to verify: Confirm that every user who is moved off SMS or voice still has at least one tested recovery path, and that help desk processes do not reintroduce the retired methods through exception handling or manual resets.
Common mistake: Treating retirement as a policy toggle rather than a migration. If users lose their primary method and the backup path fails, they will often be routed back into the weakest available channel.
Practitioner takeaway: The real objective is not just to remove legacy factors, but to remove them without creating a recovery gap that forces users and support teams back onto the weakest authentication path.
Related resources from NHI Mgmt Group
- Why does using Microsoft Entra ID as a SAML identity provider improve authentication governance for SaaS applications?
- Should you use password hash sync, pass-through authentication, or federation with Microsoft Entra ID?
- How do you block legacy authentication with Conditional Access in Microsoft Entra ID?
- How do you detect applications using the ROPC authentication flow in Microsoft Entra ID?