List every Microsoft Entra ID user whose only MFA method is SMS or a voice call, and the date Microsoft stops delivering those codes for them: February 1, 2027, or July 1, 2027 for Global Administrators and external users.
A single read-only PowerShell script. It changes nothing in your tenant: it only sends Microsoft Graph GET requests, then writes an HTML + CSV report with a verdict, the retirement date and a suggested next step for every user.
Microsoft is retiring its own SMS and voice delivery for Entra ID MFA (Microsoft Learn, "Passkeys by default and retirement of Microsoft-provided SMS and voice authentication", updated 23 Sep 2026):
- From September 1, 2026 passkeys are the default and users enabled for SMS or voice get a (snoozable) prompt to register one.
- On February 1, 2027 Microsoft-provided SMS and voice stop for everyone except Global Administrators and external users. Users whose only MFA method is SMS or voice must register a passkey at sign-in before they can continue. The prompt is blocking and there is no opt-out. Internal guest users are in this group.
- On July 1, 2027 the same happens for Global Administrators and external users.
Microsoft's own entra-sms-voice-usage-analyzer shows which policies still allow SMS and voice; its README says it is not a per-user inventory. This script lists the people.
| Source | What you learn | Needs |
|---|---|---|
User registration details (reports/authenticationMethods/userRegistrationDetails) |
Methods each user registered, default MFA method, member or guest | Entra ID P1 or P2, AuditLog.Read.All |
| Global Administrator role members (active) | Who gets the July 1, 2027 date | RoleManagement.Read.Directory |
| Authentication methods policy | Whether SMS and Voice call are enabled | Policy.Read.All |
| Verdict | Meaning | Next step |
|---|---|---|
SMS/VOICE ONLY |
Only phone methods (email and security questions are not MFA methods) | Move them before their date, or they get the blocking passkey prompt |
DEFAULT IS SMS |
Has another method, but SMS or voice is the default | Make the other method the default, then remove SMS and voice |
HAS ANOTHER METHOD |
Phone plus a stronger method | Test the other method, remove the user from the SMS and Voice policy scope |
NO MFA METHOD |
Nothing registered | Not part of this retirement; check your MFA policies |
Not affected |
No phone method | Nothing to do |
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Unblock-File .\Find-SmsOnlyUsers.ps1
.\Find-SmsOnlyUsers.ps1Or install it from the PowerShell Gallery:
Install-Script -Name Find-SmsOnlyUsers -Scope CurrentUser
Find-SmsOnlyUsers.ps1Sign in with a role such as Global Reader, Reports Reader or Security Reader and consent to the three read permissions.
Open SmsOnlyUsers-<date>.html (a CSV is written next to it).
- The registration report can be up to 36 hours old and needs Entra ID P1 or P2.
- Guests: an account with
#EXT#in its user principal name is treated as an external (B2B) user (July 1, 2027), other guest accounts as internal guests (February 1, 2027). - Only active Global Administrator assignments are seen (not eligible PIM assignments).
- Users moved to a telephony provider from Microsoft Security Store are not blocked; the script can't see that setting.
powershell -File .\tests\Test-Logic.ps1 runs the verdict, date and report logic on sample data (no tenant needed).
Guides per situation (no smartphone, shared PCs, frontline workers, guests, admins): https://mailpassed.com/entra-sms-voice-retirement
MIT License. Not affiliated with Microsoft.