MC1448374 – M365 Change Digest

One-line summary

Microsoft will retire SMS first-factor sign-in for Entra ID Free tenants on August 11, 2026, due to increased fraud risk; affected users must switch to an alternative sign-in method.

Details

Summary

Microsoft will retire SMS first-factor sign-in for Microsoft Entra ID Free tenants on August 11, 2026, due to fraud risks. Users must switch to other authentication methods before then. SMS as a multifactor method remains unaffected. Admins should identify affected users and update authentication policies accordingly.

Body (from Message Center)

Updated August 10, 2026: We have updated the timeline. We apologize for any inconvenience.

[What and why]

Microsoft will retire SMS first-factor sign-in for Microsoft Entra ID Free tenants on August 11, 2026, due to increased fraudulent activity targeting this authentication method.

SMS first-factor sign-in allows users to sign in using only a registered phone number and a one-time passcode (OTP) sent by SMS, without entering a username or password. Because this sign-in method relies solely on a registered phone number and SMS-delivered passcode, it is more susceptible to abuse and account compromise than phishing-resistant authentication methods.

This change applies only to SMS first-factor sign-in. SMS used as a multifactor authentication (MFA) method is not affected. Users can continue receiving SMS verification codes as an additional authentication factor after completing their primary sign-in.

[Rollout schedule]

Beginning August 11, 2026, SMS first-factor sign-in will no longer be supported for Microsoft Entra ID Free tenants.

[Impact on your organization]

Who is affected

Microsoft Entra ID Free tenants with SMS first-factor sign-in enabled
Users who rely exclusively on SMS first-factor sign-in

Platforms and services

Microsoft Entra ID
SMS first-factor passwordless sign-in (SignInNoPassword)

What will happen

Users in Microsoft Entra ID Free tenants will no longer be able to use SMS as a first-factor sign-in method.
Attempts to sign in using only a registered phone number and SMS one-time passcode will be blocked.
Users who have another registered authentication method can continue signing in using that method.
SMS as a multifactor authentication method is not affected.
All other registered authentication methods remain available.
Users who rely exclusively on SMS first-factor sign-in must register and use another authentication method before the retirement date.

[Action required and recommendations]

If your organization has users relying on SMS first-factor sign-in, we recommend that you:

Identify users currently using SMS first-factor sign-in.
Ensure affected users register an alternative authentication method before August 11, 2026.
Communicate this change to affected users to help prevent sign-in disruptions.
Migrate users to passkeys or other phishing-resistant authentication methods where possible.
Review authentication method policies and remove dependencies on SMS first-factor sign-in.

Learn more

Enable the SMS-based authentication method - Configure and enable users for SMS-based authentication using Microsoft Entra ID | Microsoft Learn

[Compliance considerations]

Question	Answer
Does this change modify how users access Microsoft 365 resources or services?	Yes. Users in affected Microsoft Entra ID Free tenants will no longer be able to sign in using SMS as their first-factor authentication method and must use another registered sign-in method.
Does this change require admin action to maintain user access?	Yes. Administrators should identify users who rely on SMS first-factor sign-in and ensure those users register an alternative authentication method before the retirement date to avoid sign-in disruptions.
Does this change affect authentication or access management policies?	Yes. Organizations that currently depend on SMS first-factor sign-in may need to review and update their authentication policies to remove dependencies on this retired authentication method.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": null,
    "ai_actions": [
      "Identify users using SMS first-factor sign-in",
      "Ensure affected users register an alternative authentication method",
      "Communicate the change to affected users",
      "Migrate users to phishing-resistant methods where possible",
      "Review authentication method policies and remove SMS first-factor dependencies"
    ],
    "ai_master_tags": [
      "User",
      "Admin",
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Microsoft will retire SMS first-factor sign-in for Entra ID Free tenants on August 11, 2026, due to increased fraud risk; affected users must switch to an alternative sign-in method.",
    "ai_topics": [
      "Entra"
    ],
    "category": "planForChange",
    "details_map": {
      "Summary": "Microsoft will retire SMS first-factor sign-in for Microsoft Entra ID Free tenants on August 11, 2026, due to fraud risks. Users must switch to other authentication methods before then. SMS as a multifactor method remains unaffected. Admins should identify affected users and update authentication policies accordingly."
    },
    "id": "MC1448374",
    "importance": 1,
    "is_major_change": false,
    "last_modified": "2026-08-13T20:30:56Z",
    "ms_products": [
      "Entra"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft Entra"
    ],
    "severity": "normal",
    "tags": [
      "Updated message",
      "User impact",
      "Admin impact",
      "Retirement"
    ],
    "title": "(Updated) Microsoft Entra ID: Retirement of SMS first-factor sign-in for Entra ID Free tenants"
  }
}