Microsoft phases out SMS 2FA for Entra ID, accelerates passwordless authentication with passkeys

Microsoft is finally killing SMS-based two-factor authentication for Entra ID. Starting February 1, admins will no longer be able to log in using SMS codes, and by September, Entra will prompt every user to set up a passkey. The move, driven by AI-powered phishing and SIM-swapping attacks, accelerates the shift to passwordless authentication that builders and security teams need to plan for now.

SMS codes blocked for Entra ID admins starting February 1

IT admins received an email from Microsoft outlining the phaseout, as reported by Windows Latest. The company will block SMS-based 2FA for Entra ID accounts starting February 1. Later, on September 1, Entra will begin prompting users to establish a passkey. Microsoft has also indicated that SMS codes will eventually be phased out for personal Windows Home and Pro accounts, but no specific date has been set.

AI-powered phishing and SIM-swapping are the stated reasons

Microsoft explicitly cites AI as a factor. Traditional phishing attacks become more effective when combined with AI-generated content, and AI makes SIM-swapping attacks easier to execute. Security experts have long advised against SMS-based 2FA because codes can be intercepted, but Microsoft argues that the AI era makes the risk acute enough to force a migration.

Passkeys shift authentication from servers to devices

Passkeys are device-bound credentials that use public-key cryptography. Unlike SMS codes or passwords, passkeys don't store secrets on servers, so there's nothing for attackers to steal in a server breach. They are phishing-resistant because the authentication is tied to the specific device. Microsoft already encourages users to delete passwords entirely and use passkeys as the primary login method.

A caveat: passkey data can leak from browser memory

Passkeys aren't perfect. Researchers have demonstrated that malware on a compromised system can leak passkey data stored in Google Chrome's memory. This doesn't undermine the overall security improvement over SMS, but it's a reminder that device security still matters. Microsoft acknowledges this risk in its communications.

What builders should do now

For teams building authentication flows into their products, this change reinforces the need to support passkeys and other phishing-resistant methods. If your product relies on SMS-based 2FA for Microsoft Entra ID users, you need to migrate before February 1. For broader passwordless authentication strategies, passkeys offer a strong foundation, but you should also consider fallback options like biometrics or hardware tokens. The Google selfie-based sign-in test suggests that biometric alternatives are also being explored, though it's unclear how secure that approach will be.