Move to phishing-resistant authentication before SMS and voice retire

Question

Move to phishing-resistant authentication before SMS and voice retire

Scott Weathers 20

We received the Microsoft notice “Move to phishing-resistant authentication before SMS and voice retire,” stating that Microsoft-provided SMS and voice authentication will retire on February 1, 2027.

Our production Azure AD B2C tenant uses IEF custom policies with Microsoft-provided MFA through PhoneFactorProtocolProvider (PhoneFactor-InputOrVerify) for SMS and voice authentication.

Please confirm:

Does the February 1, 2027 SMS/voice retirement apply to this Azure AD B2C implementation?
If yes, what is the Microsoft-supported replacement for existing Azure AD B2C custom-policy implementations?
If no, is there a separate retirement timeline planned for SMS/voice MFA in Azure AD B2C?

We need to determine whether changes to our production B2C authentication implementation are required before February 1, 2027.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Scott,

If you simply use Microsoft Edge to search for your first question, which I copied and pasted to remove the word 'this' and otherwise left as you typed it, you'd find the following document just as I did.

FAQ for Microsoft-provided SMS and voice retirement - Microsoft Entra ID | Microsoft Learn

Within that FAQ page is the following section, which clearly indicates the answer and obviates the need for added questions.

Will Azure AD B2C or Microsoft Entra External ID tenants be impacted by this announcement?

Azure AD B2C is out of scope and isn't affected. For Microsoft Entra External ID, this change comes next year, and a separate announcement will follow. So there's no change for either Azure AD B2C or Microsoft Entra External ID tenants with this announcement.

Rob