Microsoft is moving Microsoft Entra ID toward phishing-resistant authentication, with passkeys becoming the default authentication experience. As part of this change, Microsoft will retire its SMS and voice authentication methods on February 1, 2027.
For organizations that still have users relying on SMS or voice, this creates an important migration task. Administrators first need to understand who is affected, what authentication methods those users currently have registered, and which users depend only on SMS or voice.
This guide explains how to find users using SMS or voice authentication in Microsoft Entra ID and review their registered MFA methods so you can prepare them for the upcoming retirement.
Why Is Microsoft Retiring Telephony-Based MFA?
While SMS and voice verification are better than passwords alone, they are no longer sufficient against modern threat landscapes. Telephony-based MFA channels are highly vulnerable to:
- Malicious actors convince mobile carriers to port a victim’s phone number to a hacker-controlled device.
- Automated proxy toolkits easily intercept one-time codes in real-time.
- Advanced AI voice cloning and social engineering trick users or support staff into bypassing security guardrails.
Microsoft is therefore moving users toward stronger authentication methods, particularly passkeys, which provide phishing-resistant authentication without relying on passwords or one-time verification codes.
Microsoft SMS and Voice MFA Retirement Timeline
Microsoft will introduce the change in stages.
September 1, 2026: Microsoft will automatically enable passkeys for users who use SMS or voice and include them in the passkey registration campaign. After completing MFA, these users will receive a prompt to register a passkey..
February 1, 2027: The retirement of Microsoft-provided SMS and voice authentication takes effect across Microsoft Entra ID.
After February 1, 2027: Users who rely only on SMS or voice must register a passkey before they can continue signing in.
There is no opt-out from the February 1, 2027 enforcement. For administrators, this process begins with getting a clear picture of the MFA methods currently registered across the tenant.
How to Find Users and Their Registered MFA Methods in Microsoft 365
To find users and their registered multi-factor authentication methods in Microsoft 365, you can either use Microsoft Entra admin center or Microsoft Graph PowerShell.
Method 1: Get Users’ Registered MFA Methods Using Microsoft Entra Admin Center
Follow the below mentioned steps to export users’ registered multi-factor authentication methods in Microsoft 365.
- Sign in to the Microsoft Entra admin center as at least an Authentication Administrator or Security Reader.
- Select Entra ID on the left menu, then click on Protection.
- Under the Authentication methods section, click on User registration details.
- A table will appear listing all users. You can review key columns such as Methods Registered to see each specific MFA method (e.g., Microsoft Authenticator, FIDO2 passkey, SMS).
- Click the Download button at the top of the list to export the complete user MFA breakdown into a CSV file for auditing.
Administrators can use the exported report to identify the accounts that have methods such as Microsoft Authenticator, passkeys, software OATH tokens, SMS, or voice registered.
For smaller environments or occasional reviews, the portal provides a straightforward way to inspect MFA registration. For larger environments or recurring reporting, PowerShell provides more flexibility.
Method 2: Export Users’ Registered MFA Methods in Microsoft 365 Using PowerShell
This script iterates through your tenant, extracts user authentication records, and exports them directly into a clear CSV file.
# Connect to Microsoft Graph with the required permissions
Write-Host "[+] Connecting to Microsoft Graph..." -ForegroundColor Green
Connect-MgGraph -Scopes "User.Read.All", "AuditLog.Read.All" -NoWelcome
# Define the output location and create a timestamped CSV file name
$TargetFolder = Get-Location
$CurrentTime = Get-Date -Format "yyyyMMdd_HHmmss"
$OutputFile = "$TargetFolder\Entra_MFA_Data_$CurrentTime.csv"
Write-Host "`n[*] Extracting active member registrations from the tenant..." -ForegroundColor Cyan
# Retrieve all member users from Microsoft Entra ID
$Users = Get-MgBetaUser -All | Where-Object { $_.UserType -eq 'member' }
# Retrieve MFA registration details for each user and build the report
$ReportResults = foreach ($User in $Users) {
# Get the authentication method registration details for the current user
$LogItem = Get-MgBetaReportAuthenticationMethodUserRegistrationDetail -UserRegistrationDetailsId $User.Id -ErrorAction SilentlyContinue
if ($LogItem) {
# Replace an unset preferred authentication method with a readable value
$PrimaryMethod = $LogItem.UserPreferredMethodForSecondaryAuthentication
if ($PrimaryMethod -eq "none") { $PrimaryMethod = "Not Configured" }
# Add the required user and MFA details to the report
[PSCustomObject]@{
"Employee Name" = $User.DisplayName
"User Principal Name" = $User.UserPrincipalName
"MFA Methods Configured" = $LogItem.MethodsRegistered -join ", "
"Default Login Method" = $PrimaryMethod
}
}
}
# Export the collected MFA registration details to CSV
$ReportResults | Export-Csv -Path $OutputFile -NoTypeInformation
Write-Host "`n[+] Completed! Successfully logged $($ReportResults.Count) users." -ForegroundColor Green
Write-Host "[+] Your spreadsheet is saved at: $OutputFile" -ForegroundColor Yellow
# Prompt the administrator to open the generated CSV file
$ShellInterface = New-Object -ComObject WScript.Shell
$OpenSpreadsheet = $ShellInterface.Popup("Data pull complete.`nWould you like to open the CSV spreadsheet now?", 0, "Process Completed", 4 + 32)
if ($OpenSpreadsheet -eq 6)
{
Invoke-Item $OutputFile
}What Information Does the MFA Report Provide?
The exported report gives administrators a user-by-user view of authentication registration across the tenant.
Employee Name identifies the user associated with the authentication record.
User Principal Name provides the user’s Microsoft Entra sign-in name and makes it easier to locate the account for further investigation.
MFA Methods Configured lists the authentication methods registered for the user. This is the most important field when preparing for the SMS and voice retirement because it helps identify users who still have telephony-based authentication configured.
Default Login Method shows the user’s preferred method for secondary authentication when that information is available.
Together, these fields make it easier to distinguish between users who already have stronger authentication methods and users who may require additional preparation before February 2027.
What Should You Do After Identifying SMS and Voice Users?
Once affected users have been identified, review whether they already have a phishing-resistant authentication method available.
Users who do not have a suitable method should be encouraged to register a passkey before the retirement deadline. Registration campaigns can help organizations introduce this change gradually instead of requiring every affected user to register at the last minute.
It is also useful to repeat the MFA export periodically during the migration. Comparing reports over time can help administrators see whether the number of users relying on SMS and voice is decreasing and identify accounts that still require attention!
