Microsoft Entra ID: Microsoft-provided SMS and voice authentication to retire for self-service password reset (SSPR)
🚨
Major Update: This post contains a significant change that may impact your organisation.
What and why
As Microsoft-provided SMS and voice authentication retire in Microsoft Entra ID, these methods will also become unavailable for SSPR. Organizations have 50 days after the applicable sign-in retirement rollout reaches their tenant to prepare alternative recovery methods. Users may still be able to sign in but lose the ability to reset forgotten passwords. Passkeys and other sign-in methods don't automatically satisfy SSPR requirements. Admins should identify affected users and ensure they have enough eligible recovery methods to prevent disruptions and increased helpdesk requests.
Rollout schedule
- General Availability (Worldwide, GCC): We expect rollout to begin and complete in February 2027
User population | Sign-in retirement rollout begins | SSPR transition ends |
Users other than Global Administrators and external users | February 1, 2027 | 50 days after this rollout reaches your tenant |
Global Administrators and external users | July 1, 2027 | 50 days after this separate rollout reaches your tenant |
These are phased rollout start dates, not a single SSPR cutoff for every organization. Each population's 50-day period begins when its applicable rollout reaches your tenant.
Impact on your organization
Who is affected
- Organizations with users who rely on Microsoft-provided SMS/voice to meet their password-reset verification requirements. This includes users who have another sign-in method but still depend on SMS/voice for password recovery.
Platforms and services
- Microsoft Entra ID SSPR
What will happen
When the applicable sign-in retirement rollout reaches your tenant:
- 50-day transition: Existing SMS and voice registrations remain usable for SSPR under your current recovery policy.
- Registration changes: SMS/voice SSPR registration and refresh prompts stop, but prompts for other eligible methods continue.
- My Sign-Ins: Users can no longer add SMS/voice methods or edit authentication phone numbers. Existing phone registrations appear disabled, even while usable for SSPR during the transition.
- Customer-managed telephony (CYOT): Recovery through supported providers remains available.
After the 50-day transition period:
Microsoft-provided SMS and voice are no longer available as SSPR recovery options.
User's remaining eligible recovery methods | Password-reset experience |
Enough methods to meet the applicable SSPR requirement | User can continue resetting their password with those methods |
Not enough methods to meet the applicable SSPR requirement | User cannot complete SSPR and is directed to contact their administrator |
The applicable one/two method requirement still applies. To retain SMS/voice for recovery, your organization must configure a supported CYOT.
Microsoft will not automatically change your SSPR policy or enable Allow password change after secure sign-in for your tenant.
Action required and recommendations
Prepare affected users before their applicable 50-day transition period ends:
- Identify affected users. Find users relying on SMS/voice for SSPR, even if they have other sign-in methods registered. Use the SMS and voice retirement and migration guidance.
- Prepare alternative recovery methods. Ensure users have enough eligible methods to meet SSPR policy requirements without Microsoft-provided SMS/voice. Passkeys alone don't satisfy SSPR requirements. If phone recovery is needed, configure and test a supported telephony provider before the transition ends.
- Test and communicate. Verify password recovery works with your SSPR policies and Conditional Access settings. Inform users and helpdesk staff about deadlines, registration steps, and support options.
Recommended: Let passkey users change a forgotten password
- Where available, administrators can enable Allow password change after secure sign-in for eligible users. Users can then sign in with their passkey and change their password in My Sign-Ins without knowing/entering their current password.
Learn more
- SMS and voice retirement and migration guidance
- How Microsoft Entra self-service password reset works
- Choose a telephony provider for SMS and voice authentication
Compliance considerations
If your organization needs phone-based recovery for regulatory or operational reasons, plan and validate a supported customer-managed provider before the applicable SSPR cutoff.