Entra ID retires Microsoft's SMS and voice codes for password reset

Entra ID retires Microsoft's SMS and voice codes for password reset

3 November 2026: Microsoft is retiring the SMS and voice calls it sends itself as recovery methods for self-service password reset (SSPR) in Microsoft Entra ID. Users who reset a forgotten password with a text message or phone call today will need another method, and Microsoft flags the change as major, with impact on both users and administrators and an action date of 22 March 2027.

Not yet independently verified. We read the notice in the Message Center archive at mc.merill.net, which mirrors Microsoft's text; we have not yet found the same dates on a Microsoft-hosted page. We will update this when it can be confirmed, and remove this note.

Two rollout waves, each with 50 days of grace

The retirement reaches tenants in two groups:

• From 1 February 2027: all users except Global Administrators and external users.
• From 1 July 2027: Global Administrators and external (guest) users.

When the rollout reaches a tenant, each group gets a 50-day SSPR transition. During those 50 days, existing SMS and voice registrations still work for password reset, but Entra stops prompting users to register or refresh them, and nobody can add a new SMS or voice method. After the transition, a user with no other qualifying method cannot reset their own password and has to call the helpdesk. The change applies to the worldwide service and to GCC.

The passkey catch

Many organisations have spent the year moving staff to passkeys and might assume that covers recovery. It does not: Microsoft says a passkey on its own does not satisfy SSPR. Users need another registered method that SSPR accepts, such as an authenticator app notification or code, a second email address or security questions where the tenant allows them. Microsoft suggests considering the setting that allows a password change after a secure sign-in, which lets a user who can still sign in with a strong method change the password without a reset flow.

Phone-based recovery is not gone entirely. Organisations that bring their own telephony provider, which Microsoft calls customer-managed telephony (CYOT), can keep SMS or voice recovery through that provider; it is the Microsoft-sent messages that retire.

Preparing the helpdesk before February

The likely failure is quiet: nothing breaks on 1 February, and the calls start about seven weeks later when the transition ends and users who only ever registered a phone number find they cannot reset. Microsoft's own list of preparation steps is to identify affected users, prepare alternative methods, test SSPR and Conditional Access together, and brief users and the helpdesk. The authentication methods registration report in the Entra admin centre shows which users have only SMS or voice registered, and that list is the one to work through first.

Global Administrators get until July, but a tenant whose admins rely on SMS recovery should move them early rather than risk an admin account that cannot be recovered without a support case.

Our catalogue lists 7 authentication software products, 7 identity management products and 15 password management products.

Related on TrustList:

• Microsoft Authenticator for Android let any app pose as Teams and get work tokens
• Entra ID adds passkeys for guest users, on by default
• Norway's security authority raises national cyber risk level to high

Sources

• Microsoft 365 Message Center archive (merill.net): MC1536049 Microsoft Entra ID, Microsoft-provided SMS and voice authentication to retire for self-service password reset, 3 November 2026