Microsoft Entra Will Switch Off SMS First-Factor Sign-In in Tenants Where Nobody Uses It, With the Rollout Ending in Late November: Check Your Setting and Who Depends on It (MC1465763)
Microsoft is switching off SMS first-factor sign-in in Entra tenants where nobody really uses it. Message Center item MC1465763 was published September 1, 2026 and updated October 28, and the update moved the rollout. It now runs from mid September until the end of November 2026. If you do nothing and your tenant meets the rule, Microsoft clears the setting for you.
This is not the same change as the retirement of Microsoft provided SMS and voice MFA on February 1, 2027, which I covered in an earlier post. First-factor sign-in means a user types a phone number and receives a code instead of a password. SMS codes used as a second step for MFA or for password reset are explicitly not affected here.
Quick guide
- Open the SMS method. Sign in with at least the Authentication Policy Administrator role. Go to Entra ID, then Authentication methods, then Policies, then select SMS.
- Look at the Use for sign-in setting under SMS-based authentication. If it is not ticked anywhere, there is nothing for Microsoft to switch off.
- Review 30 days of sign-ins. The rule looks at the last 30 days. Find users who sign in with SMS only, and failed attempts. The notice does not say which report to use, so use the Entra sign-in logs and check the authentication details of each sign-in.
- Register another method for every user who relies on SMS sign-in, ideally a passkey. My passkey tutorial shows the steps.
- Tell those users before the rollout reaches your tenant, or clear the setting yourself if you no longer need it.
When does Microsoft switch it off?
Per the notice, Microsoft disables SMS first-factor sign-in automatically in a tenant that meets either condition:
| Condition in the previous 30 days | Result |
|---|---|
| No successful SMS first-factor sign-in | Setting is cleared |
| Every SMS first-factor attempt failed | Setting is cleared |
| At least one success | Setting stays as it is |
Not affected: SMS for MFA, SMS for SSPR and password based sign-in. Microsoft’s stated reason is significant fraud activity aimed at SMS first-factor sign-in, and the point that it does not enforce MFA.
Read the SMS policy with Graph
The SMS policy is an authentication method configuration with the id sms. Microsoft’s Graph reference lists its includeTargets as the groups allowed to use it, and each target carries an isUsableForSignIn flag. That flag is what the portal shows as Use for sign-in. This read needs the Policy.Read.All permission.
Connect-MgGraph -Scopes 'Policy.Read.All'
$u = 'https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/sms'
(Invoke-MgGraphRequest -Method GET -Uri $u).includeTargetsAny target with isUsableForSignIn set to true means SMS sign-in is allowed for that group. If every target shows false, the setting is already off.
What I could and could not check
I did not sign in to an Entra tenant for this post, so there are no portal screenshots and I did not run the command above. My lab service principal has no Graph policy permissions. A read of the SMS configuration returned HTTP 403 with Request Authorization failed. I read MC1465763 through a public mirror of the Message Center. The mirror page gives the updated date and the rule, so check both in your own Message Center.
FAQ
What exactly is SMS first-factor sign-in?
Signing in with a phone number and a text message code instead of a password. It is controlled by the Use for sign-in setting of the SMS authentication method.
Does this stop SMS for MFA or password reset?
No. The notice says SMS for MFA and SSPR is not affected.
When will Microsoft switch it off in my tenant?
The rollout started in mid September and is expected to finish at the end of November 2026, after the October 28 update moved the date.
How can I keep it?
Make sure legitimate users sign in with SMS successfully and have another method registered. Microsoft clears the setting only when there was no success or only failures in the last 30 days.
Who can change the setting?
The notice names the Authentication Policy Administrator role.
