Summary
- Microsoft Entra ID is retiring Microsoft-provided SMS and voice authentication for self-service password reset (SSPR).
- Users who currently rely on SMS/voice for password recovery may lose SSPR access unless they have enough other eligible recovery methods configured.
- Existing SMS/voice registrations can continue to work during the transition period, but users will no longer be able to add or refresh those methods in My Sign-Ins.
- Admins should identify affected users, ensure alternative recovery methods are in place, and consider customer-managed telephony if phone-based recovery must be retained.
- Microsoft will not automatically update your SSPR policy, so tenant configuration and user communication are required.
Primary Service: Entra
Admin Impact: High
User Impact: Medium
Release Start: 01 Feb 2027
Release End: 01 Feb 2027
Services: Entra
Category: Plan for change
Tags: Admin Action, Retirement, User Adoption
History
11/3/2026 Item Added to Message Center
Microsoft Message
As Microsoft-provided SMS and voice authentication retire in Microsoft Entra ID, these methods will also become unavailable for SSPR. Organizations have 50 days after the applicable sign-in retirement rollout reaches their tenant to prepare alternative recovery methods. Users may still be able to sign in but lose the ability to reset forgotten passwords. Passkeys and other sign-in methods don’t automatically satisfy SSPR requirements. Admins should identify affected users and ensure they have enough eligible recovery methods to prevent disruptions and increased helpdesk requests.
Rollout schedule
General Availability (Worldwide, GCC): We expect rollout to begin and complete in February 2027
| User population | Sign-in retirement rollout begins | SSPR transition ends |
|---|---|---|
| Users other than Global Administrators and external users | February 1, 2027 | 50 days after this rollout reaches your tenant |
| Global Administrators and external users | July 1, 2027 | 50 days after this separate rollout reaches your tenant |
These are phased rollout start dates, not a single SSPR cutoff for every organization. Each population’s 50-day period begins when its applicable rollout reaches your tenant.
Impact on your organization
Who is affected
Organizations with users who rely on Microsoft-provided SMS/voice to meet their password-reset verification requirements. This includes users who have another sign-in method but still depend on SMS/voice for password recovery.
Platforms and services
Microsoft Entra ID SSPR
What will happen
When the applicable sign-in retirement rollout reaches your tenant:
- 50-day transition: Existing SMS and voice registrations remain usable for SSPR under your current recovery policy.
- Registration changes: SMS/voice SSPR registration and refresh prompts stop, but prompts for other eligible methods continue.
- My Sign-Ins: Users can no longer add SMS/voice methods or edit authentication phone numbers. Existing phone registrations appear disabled, even while usable for SSPR during the transition.
- Customer-managed telephony (CYOT): Recovery through supported providers remains available.
After the 50-day transition period:
Microsoft-provided SMS and voice are no longer available as SSPR recovery options.
| User’s remaining eligible recovery methods | Password-reset experience |
|---|---|
| Enough methods to meet the applicable SSPR requirement | User can continue resetting their password with those methods |
| Not enough methods to meet the applicable SSPR requirement | User cannot complete SSPR and is directed to contact their administrator |
The applicable one/two method requirement still applies. To retain SMS/voice for recovery, your organization must configure a supported CYOT.
Microsoft will not automatically change your SSPR policy or enable Allow password change after secure sign-in for your tenant.
Action required and recommendations
Prepare affected users before their applicable 50-day transition period ends:
- Identify affected users. Find users relying on SMS/voice for SSPR, even if they have other sign-in methods registered. Use the SMS and voice retirement and migration guidance.
- Prepare alternative recovery methods. Ensure users have enough eligible methods to meet SSPR policy requirements without Microsoft-provided SMS/voice. Passkeys alone don’t satisfy SSPR requirements. If phone recovery is needed, configure and test a supported telephony provider before the transition ends.
- Test and communicate. Verify password recovery works with your SSPR policies and Conditional Access settings. Inform users and helpdesk staff about deadlines, registration steps, and support options.
Recommended: Let passkey users change a forgotten password
- Where available, administrators can enable Allow password change after secure sign-in for eligible users. Users can then sign in with their passkey and change their password in My Sign-Ins without knowing/entering their current password.
Learn more
- SMS and voice retirement and migration guidance
- How Microsoft Entra self-service password reset works
- Choose a telephony provider for SMS and voice authentication
Compliance considerations
If your organization needs phone-based recovery for regulatory or operational reasons, plan and validate a supported customer-managed provider before the applicable SSPR cutoff.