Microsoft to retire SMS login as AI phishing surges
Microsoft says AI has increased the effectiveness of phishing targeting SMS and voice authentication, including SIM swapping. It will make passkeys the default sign-in method for Microsoft Entra ID, with phased enrollment starting Sept. 1, 2026, opt-out via Microsoft Graph from Aug. 1, 2026, and retirement of SMS/voice auth on Feb. 1, 2027.
How this was made
The 30-second read
Why it matters
By defaulting Entra ID sign-in to passkeys and retiring SMS/voice authentication on a fixed schedule, Microsoft is attempting to reduce account compromise risk and shift customers toward phishing-resistant authentication.
Market read
This is a dated security roadmap update for a major enterprise identity platform, relevant to IT security budgets and customer migration planning.
What to watch
Lockout risk for tenants that do not configure customer-managed telecom providers by the stated deadlines could increase support costs and change-management demand for Microsoft partners.
Background
Microsoft is warning that AI has increased the effectiveness of phishing targeting SMS and voice authentication, including SIM swapping and MFA code theft.
Ticker impact
Microsoft says it will retire Entra ID SMS and voice authentication on Feb 1, 2027 and move users to passkeys by Sept 1, 2026.
Limited direct near-term impact on MSFT shares, but it can support longer-term trust and retention in identity/security offerings.
The article discloses a specific, dated authentication retirement and enrollment timeline for Entra ID, but it does not provide financial metrics, guidance, or a quantified revenue impact.
Market effects
Identity and access management vendors may face competitive pressure to accelerate phishing-resistant authentication and passkey support.
No clear regional market-specific effect is stated; impact is primarily enterprise IT security operations.
Broad applicability across multinational enterprises using Entra ID could influence global IAM security spending priorities.
Counterpoint
Enterprises may delay opt-in via the opt-out feature, and telecom-provider configuration complexity could create short-term friction rather than immediate security improvement.
Key entities
- productMicrosoft Entra ID
Microsoft’s enterprise identity and access management platform referenced as the scope for the authentication changes.
- platformMicrosoft Graph
The channel Microsoft will provide an opt-out feature through starting Aug 1, 2026.
- platformMicrosoft Security Store
Where organizations must configure customer-managed telecom provider options to avoid SMS/voice lockout.
