SMS / Voice MFA Retirement Exposure
The question it answers: Which users lose MFA when Microsoft-provided SMS and voice end, because a phone is their only or default second factor?
Microsoft is retiring SMS and voice-call as Microsoft-provided MFA methods. Users whose only second factor is a phone number will be unable to complete MFA once the service ends. Per Microsoft: registration nudges towards passkeys started 1 September 2026, a customer-managed telephony fallback must be configured by 30 October 2026, and Microsoft-provided SMS/voice ends on 1 February 2027 (https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement). What to do: phone only - have the user register Microsoft Authenticator or a passkey before the fallback deadline, admins first; phone is default - enable system-preferred MFA so the stronger method is offered first; phone as backup - no urgent action, the phone method simply stops working.
At a glance
Section titled “At a glance”| Where in the app | Entra ID › Security › SMS/Voice Retirement Exposure |
| Workload | Entra ID |
| Kind | Table |
| Data | Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once. |
| Licence | Microsoft Entra ID P1 (authentication methods registration details). |
| Report id (API and MCP) | entra.security.sms-voice-retirement |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Display Name | DisplayName | Link |
| User Principal Name | UserPrincipalName | Text |
| Exposure | ExposureState | Status |
| Admin | IsAdmin | YesNo |
| Phone methods | PhoneMethodsString | Text |
| Other methods | StrongerMethodsString | Text |
| Preferred method | PreferredSecondaryMethod | Text |
| System-preferred MFA | IsSystemPreferredEnabled | Text |
| User type | UserType | Text |
Filters
Section titled “Filters”| Filter | Key (API) | On when the page opens |
|---|---|---|
| Show only affected users | affected | Yes |
| Show only administrators | admins | No |
What it needs
Section titled “What it needs”Licence: Microsoft Entra ID P1 (authentication methods registration details).
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
AuditLog.Read.All | Microsoft Graph | Read all audit log data |
Data sources it reads
GET /v1.0/reports/authenticationMethods/userRegistrationDetails
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.security.sms-voice-retirement?size=100GET /ir-api/v1/reports/entra.security.sms-voice-retirement?filter=affectedAn AI assistant reads it with the MCP tool get_report and the id entra.security.sms-voice-retirement. The client needs the Read grant for Entra ID. See Using the API.