Microsoft Entra ID: Microsoft-provided SMS and voice authentication to retire for self-service password reset (SSPR)

[What and why]

As Microsoft-provided SMS and voice authentication retire in Microsoft Entra ID, these methods will also become unavailable for SSPR. Organizations have 50 days after the applicable sign-in retirement rollout reaches their tenant to prepare alternative recovery methods. Users may still be able to sign in but lose the ability to reset forgotten passwords. Passkeys and other sign-in methods don't automatically satisfy SSPR requirements. Admins should identify affected users and ensure they have enough eligible recovery methods to prevent disruptions and increased helpdesk requests.

[Rollout schedule]

• General Availability (Worldwide, GCC): We expect rollout to begin and complete in February 2027

These are phased rollout start dates, not a single SSPR cutoff for every organization. Each population's 50-day period begins when its applicable rollout reaches your tenant. 

[Impact on your organization]

Who is affected

• Organizations with users who rely on Microsoft-provided SMS/voice to meet their password-reset verification requirements. This includes users who have another sign-in method but still depend on SMS/voice for password recovery.

Platforms and services

• Microsoft Entra ID SSPR

What will happen

When the applicable sign-in retirement rollout reaches your tenant:

• 50-day transition: Existing SMS and voice registrations remain usable for SSPR under your current recovery policy.
• Registration changes: SMS/voice SSPR registration and refresh prompts stop, but prompts for other eligible methods continue.
• My Sign-Ins: Users can no longer add SMS/voice methods or edit authentication phone numbers. Existing phone registrations appear disabled, even while usable for SSPR during the transition.
• Customer-managed telephony (CYOT): Recovery through supported providers remains available.

After the 50-day transition period:

Microsoft-provided SMS and voice are no longer available as SSPR recovery options.

The applicable one/two method requirement still applies. To retain SMS/voice for recovery, your organization must configure a supported CYOT.

Microsoft will not automatically change your SSPR policy or enable Allow password change after secure sign-in for your tenant.

[Action required and recommendations]

Prepare affected users before their applicable 50-day transition period ends:

1. Identify affected users. Find users relying on SMS/voice for SSPR, even if they have other sign-in methods registered. Use the SMS and voice retirement and migration guidance.
2. Prepare alternative recovery methods. Ensure users have enough eligible methods to meet SSPR policy requirements without Microsoft-provided SMS/voice. Passkeys alone don't satisfy SSPR requirements. If phone recovery is needed, configure and test a supported telephony provider before the transition ends.
3. Test and communicate. Verify password recovery works with your SSPR policies and Conditional Access settings. Inform users and helpdesk staff about deadlines, registration steps, and support options.

Recommended: Let passkey users change a forgotten password

• Where available, administrators can enable Allow password change after secure sign-in for eligible users. Users can then sign in with their passkey and change their password in My Sign-Ins without knowing/entering their current password.

Learn more

• SMS and voice retirement and migration guidance
• How Microsoft Entra self-service password reset works
• Choose a telephony provider for SMS and voice authentication

[Compliance considerations]

If your organization needs phone-based recovery for regulatory or operational reasons, plan and validate a supported customer-managed provider before the applicable SSPR cutoff.