Microsoft Phases Out SMS Authentication Amid Rising AI Phishing Threats

Microsoft has issued a warning to IT administrators to discontinue SMS and voice-based authentication due to the increasing threat of AI-assisted phishing. The company cites a significant rise in successful attacks that exploit these methods, facilitated by AI technologies that ease SIM swapping and credential theft. Starting September 1, 2026, Entra users will be required to set up passkeys, with a complete retirement of SMS and voice authentication planned for February 1, 2027. Personal Microsoft accounts will also see changes, although no specific deadline has been provided for consumers. Microsoft emphasizes that the transition to more secure authentication methods is critical as AI makes traditional methods more vulnerable. Users are encouraged to adopt passkeys or Microsoft Authenticator to enhance security.

Key Points: • Microsoft will retire SMS and voice authentication for Entra ID by February 1, 2027. • AI-driven phishing attacks are increasing, making SMS authentication more vulnerable. • Users are urged to switch to passkeys or Microsoft Authenticator immediately.