**Microsoft** has reiterated its call for **Entra ID** administrators to migrate users to more robust, phishing-resistant authentication methods. This directive comes ahead of the planned retirement of SMS and voice authentication for **Entra ID** workforce tenants, set to begin on February 1, 2027. This retirement specifically targets **Microsoft Entra ID** workforce tenant authentication scenarios and does not impact **Azure AD B2C** or **Microsoft Entra External ID** customer identity scenarios. ### The Urgency of Migration Administrators are strongly advised to ensure all users in their organizations adopt a phishing-resistant method well before the 2027 deadline. Failure to do so will result in users being unable to complete multifactor authentication (MFA) and log into their accounts. Acceptable phishing-resistant alternatives include passkeys, QR code authentication, **FIDO2** security keys, and other **Entra ID**-supported sign-in methods. In a recent **Microsoft 365 Message Center** update, Microsoft stated, "SMS and voice are vulnerable to phishing and SIM-swap attacks. Microsoft recommends passkeys for stronger, phishing-resistant protection. You can also migrate to another supported authentication method or retain SMS and voice by configuring a customer-managed telecom provider (**CYOT**) through the Microsoft Security Store." ### Identifying Vulnerable Users For administrators with Authentication Policy Administrator, Global Reader, or Security Reader roles, the **Entra SMS/Voice Policy Scanner PowerShell script** (available on GitHub) can be used to identify users currently relying on SMS or voice authentication. Organizations that require phone-based authentication will need to configure third-party telecom providers via the **Microsoft Security Store** to retain this functionality after the 2027 cutoff. ### Passkeys as the New Default **Microsoft** announced in July that passkeys would become the default authentication experience for the **Entra ID** enterprise identity service, with rollout commencing in September. As this transition progresses, users enabled for SMS or voice authentication will automatically be enabled for passkeys and prompted to register one during their next MFA event. This move reinforces Microsoft's commitment to enhancing security by phasing out less secure authentication methods. The company previously retired SMS first-factor sign-in for **Microsoft Entra ID Free** tenants in August due to elevated risks of phishing, fraud, and account compromise. Comprehensive guidance on deploying and managing phishing-resistant passwordless authentication in **Entra ID** is available on dedicated Microsoft documentation pages.  ### After Initial Access: A Glimpse into Post-Compromise Actions While overall prevention scores are crucial, understanding post-compromise activity is equally vital. Recent analysis indicates that once attackers acquire valid credentials, only 37% of their subsequent actions are blocked. This highlights a significant gap in defense layers after initial access has been gained. The Blue Report 2026, which measures defenses technique by technique across 338 million simulations in customer production environments, offers deeper insights into these post-compromise scenarios.