Microsoft Entra ID: Updates to SMS and voice verification experiences

[What and why]

Microsoft Entra ID is updating SMS and voice verification experiences to show more secure verification methods first when they are available and to reduce unnecessary code sends. Telephony-based authentication methods are less secure than alternative authentication methods. SMS and voice are not being removed as part of this change and remain available by selecting Show more verification methods.

[Rollout schedule]

• Beginning in mid-October 2026 and expected to complete by late October 2026

[Impact on your organization]

Who is affected

• Users who have SMS or voice and at least one non-telephony verification method available for an affected authentication flow

Platforms and services

• Microsoft Entra ID authentication experiences that use SMS or voice verification

What will happen

• SMS and voice options are not being removed.
• If telephony is the only available method for the authentication flow, the experience remains unchanged.
• When users have SMS or voice plus at least one non-telephony verification method, Microsoft Entra ID will show the more secure non-telephony methods first.
• SMS or voice will remain available under Show more verification methods instead of appearing in the initial list.
• After a valid SMS or voice code is sent, users may need to wait a few minutes before another code can be sent.
• During the waiting period, users should wait for the code already requested to arrive. Previously sent codes remain valid.
• If the code does not arrive by the time the waiting period has passed, users can request another code using the same experience they use today.

[Action required and recommendations]

No configuration change is identified for this update. We recommend that you:

• Prepare your help desk for users who may see more secure verification methods shown before SMS or voice. SMS and voice remain available by selecting Show more verification methods.
• Be aware that the resend waiting period does not indicate an SMS or voice delivery failure. Codes can take a few minutes to arrive.
• If a code is not delivered as expected, review Troubleshoot MFA voice call and SMS problems. SMS and voice delivery can be affected by carrier routing, device or carrier blocking, regional availability, and other downstream telecom-provider issues.
• Review the Microsoft Entra multifactor authentication FAQ for additional information about Microsoft Entra multifactor authentication experiences.
• Separately, continue planning for the February 1, 2027 retirement of Microsoft-provided SMS and voice authentication for users in scope.
• Where possible, continue moving users toward phishing-resistant authentication methods such as passkeys (FIDO2). Passkeys provide phishing-resistant authentication based on FIDO standards.
• If your organization will continue to require SMS or voice authentication after February 1, 2027, evaluate Choose Your Own Telephony Provider as part of your planning.

Learn more

• Troubleshoot MFA voice call and SMS problems - Microsoft Entra ID | Microsoft Learn
• Microsoft Entra multifactor authentication FAQ - Microsoft Entra ID | Microsoft Learn
• Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - Microsoft Entra ID | Microsoft Learn
• Passkeys (FIDO2) authentication method in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn
• Choose a telephony provider for SMS and voice authentication - Microsoft Entra ID | Microsoft Learn

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.