Home / Blog / News and Research / Microsoft Retires SMS, Voice and Secret Questions: What Are Your Options?

Microsoft Retires SMS, Voice and Secret Questions: What Are Your Options?

Microsoft is making significant changes to authentication in Entra ID. Passkeys are now the default sign-in method, and Microsoft-provided SMS and voice authentication will be retired from February 2027. Security questions, another long-standing verification method, will also disappear from self-service password reset (SSPR) shortly afterwards.

The changes are part of Microsoft’s wider push towards phishing-resistant authentication. While they promise stronger security, they also present a practical challenge for organizations that still rely on traditional verification methods, particularly for password resets and account recovery.

So, how will this affect organizations, and what options are available for those that still need SMS, voice or security questions?

What if You Still Need SMS, Voice or Secret Questions?

For desk-based employees, moving to the supported MFA and SSPR methods should be relatively straightforward. But for those working in manufacturing plants, on construction sites or in other frontline roles, these methods aren’t always practical.

Some employees may also be reluctant to change familiar processes, while others may not have a smartphone to use an authenticator app. This can make it difficult for organizations to ensure everyone can securely reset their passwords when needed.

Specops offers two solutions to help security teams overcome these challenges, for employees resetting their passwords themselves or contacting the IT service desk:

Maintaining Flexible SSPR

Specops uReset allows employees to securely reset Active Directory and Microsoft Entra ID passwords from any location, device or browser, whether connected to the corporate VPN or not. For Active Directory environments, it also updates locally cached Windows credentials.

Crucially, Specops uReset supports a wide range of authentication methods; it can even be configured to require multiple factors to ensure secure identity verification. For instance, users can first verify their identity using a one-time passcode (OTP) before answering security questions as an additional verification step. This allows organizations to retain familiar recovery methods even after Microsoft retires native support.

Securing Password Resets and Account Unlocks Through the Service Desk

When self-service doesn’t work, the IT helpdesk typically remains the first point of contact. Specops Secure Service Desk helps agents verify callers before granting access or approving sensitive requests, reducing the risk of social engineering and fraudulent password resets.

Like Specops uReset, it supports layered authentication that combines factors like OTP verification with security questions as an additional check. Verification events also feed directly into security operations workflows, helping teams monitor activity and investigate suspicious requests.

The Retirement Timeline

Date	What’s Changing
September 1, 2026	Passkeys became the default for authentication. Users enabled for SMS or voice are now automatically enabled for passkeys and prompted to register during MFA sign-in.
February 1, 2027	Microsoft-provided SMS and voice authentication is retired for most users. Those relying exclusively on these methods for MFA must register a passkey to continue signing in, unless migrated to a supported telephony provider.
March 2027	Security questions are retired as an SSPR verification method.
July 1, 2027	Microsoft-provided SMS and voice authentication is retired for Global Administrators and external users.

These dates apply to Microsoft Entra ID public cloud environments. Other cloud environments will follow separate timelines.

What Options Are Left For Windows Authentication and SSPR?

Microsoft’s preferred alternatives focus on passwordless and phishing-resistant authentication. For Windows sign-in and Microsoft Entra authentication, organizations can use passkeys (including FIDO2 hardware security keys) and Windows Hello for Business, which supports PINs and biometric authentication.

Hardware security keys are particularly useful for employees without smartphones, although organizations must consider device compatibility, distribution and replacement costs. Microsoft Authenticator also remains available for MFA, using push notifications and one-time codes.

For SSPR, the options are more limited. After security questions are retired in March 2027, Microsoft’s natively supported methods will be:

• Microsoft Authenticator notifications
• Hardware or software OATH tokens
• Email one-time passcodes

Organizations will need to assess whether these methods meet the needs of their users, particularly those without access to smartphones or registered authentication devices.

Can You Keep SMS and Voice Through Microsoft?

Technically, yes. From October 30, 2026, Microsoft lets you keep SMS and voice by contracting with a third-party telephony provider through the Microsoft Security Store. It isn’t a like-for-like swap, though. You take on a new vendor contract and new per-message costs, procurement needs to sign off, and Microsoft positions it as an exception for users with a documented compliance need rather than a general option. It also does nothing for security questions, which disappear from SSPR regardless.

What Can Organizations Do to Prepare?

The February deadline gives organizations time to prepare, but changing established authentication methods involves more than simply updating a policy.

Review Existing Authentication Policies

Audit your Microsoft Entra authentication methods policy, including legacy MFA settings and SSPR configuration. Microsoft provides a PowerShell script to find users enabled for SMS and Voice in Entra ID.

Pay particular attention to employees using shared workstations, basic mobile phones or devices with limited connectivity, as these circumstances can make adopting passkeys and authenticator apps more challenging.

Migrate to Passkeys Where Practical

For employees with compatible devices, passkeys provide stronger protection against phishing and credential theft.

Start with a pilot group before expanding deployment. FIDO2 security keys offer secure authentication for employees who cannot use smartphones. If the employees use managed Windows devices, Windows Hello for Business is another secure option.

Communicate the Change

Microsoft recommends a phased communication approach, starting with awareness of the upcoming retirement, followed by registration instructions and reminders for users who haven’t completed the transition.

Make sure employees understand which authentication methods they should register and what to do if they cannot complete the process. Providing clear instructions and support ahead of the deadline will help reduce avoidable account lockouts and help desk requests.

Provide Training and Support

Even straightforward authentication changes can cause frustration if employees are unfamiliar with the technology. Offer clear instructions, practical demonstrations and opportunities to ask questions. Employees who prefer familiar authentication processes may benefit from additional hands-on support. Explaining why changes are happening may help employees adopt a new method.

Test Password Recovery and Fallback Processes

Alongside authentication, organizations must consider what happens when employees forget passwords, lose security keys or cannot access their registered devices.

Test recovery processes across different locations, devices and network conditions. Make sure service desk teams have secure alternatives for employees who cannot complete SSPR.

Ensure All Your Users Can Securely Authenticate with Specops

Not every employee can, or wants to, move to passkeys and authenticator apps. For organizations that will still need to rely on methods being retired natively by Microsoft, finding a secure alternative is essential to keeping employees connected and productive.

Specops can help you maintain that familiarity for password reset verification options outside of Microsoft’s native methods, without compromising security. Book a demo today to see how we can help.

Last updated on October 27, 2026