Microsoft’s SMS and Voice Phaseout: A New Opportunity for MSPs

Looking ahead to next year, major technology providers are adopting stronger, phishing-resistant authentication methods. Among them is Microsoft, which is phasing out its native SMS and voice authentication services in favor of more secure alternatives, including passkeys, beginning February 1, 2027. The change will initially affect most Microsoft Entra ID users, then extend to Global Administrators and external users on July 1, 2027. 

For Managed Service Providers (MSPs), Microsoft’s announcement represents more than another technology deadline. It creates an opportunity to reassess how identities are protected, credentials are managed and security policies are enforced across their client environments.

What’s changing and when?

For years, organizations have used text messages and automated calls to add security beyond passwords. However, these methods have not kept pace with today’s evolving threat landscape and remain vulnerable to common attacks such as phishing, SIM swapping and social engineering. 

Microsoft began preparing users for the transition in September 2026 by introducing passkey registration prompts during MFA sign-in. Users could postpone registration during the initial rollout, but those whose only MFA method is Microsoft-provided SMS or voice authentication will need to register a passkey to keep signing in once the retirement takes effect. Organizations that have not prepared could face authentication disruptions, increased support requests and reduced productivity. 

It’s worth noting that Microsoft is retiring its native delivery of SMS and voice authentication, not eliminating these methods entirely. Organizations with legitimate regulatory or operational needs can continue using them by configuring a telephony provider through the Microsoft Security Store before their applicable retirement deadline.

While this option remains available, Microsoft’s efforts to make phishing-resistant authentication the standard rather than the exception are clear.

Why this matters for MSPs

For MSPs managing multiple client environments, Microsoft’s transition introduces both an immediate operational responsibility and a broader opportunity to strengthen client security. 

A single MSP may support dozens or hundreds of organizations, each with different authentication configurations, user populations and levels of security maturity. Some clients may already use passkeys or other phishing-resistant methods, while others still depend heavily on text messages and phone calls.

The challenge goes beyond updating a Microsoft setting. Proactive MSPs should identify affected users, determine appropriate authentication methods, communicate changes, support enrollment and ensure users can continue accessing business-critical systems.

Clients with limited internal IT resources may be particularly dependent on their MSP to manage this process.

How passkeys improve authentication and credential security

Passkeys significantly improve authentication security. 

Unlike traditional passwords and one-time verification codes, passkeys use cryptographic key pairs to authenticate users. The private key remains protected on the user’s device or credential manager, while the corresponding public key is registered with the service.

Because authentication is tied to the legitimate website or application and the private key is never transmitted, passkeys are resistant to phishing attacks that exploit traditional authentication methods.

While this represents a meaningful step forward, adopting passkeys for Microsoft authentication does not automatically resolve credential security challenges elsewhere in a client’s environment.

Many business applications and administrative systems still rely on traditional passwords, requiring organizations to maintain protections for these credentials.

Shared accounts, reused passwords and inconsistent access policies can add risk, especially during employee onboarding, role changes, offboarding and third-party access.

Microsoft’s transition addresses how users authenticate to its services, but what about the credentials employees rely on elsewhere? Waiting for another mandate only prolongs the risks. Improving one authentication method does not eliminate the need for a comprehensive credential security strategy.

Beyond Microsoft’s mandate: The MSP opportunity 

Helping clients transition away from SMS and voice authentication can reveal security gaps that might otherwise go unnoticed.

For example, an MSP helping a client adopt passkeys for Microsoft sign-in might discover that employees still store passwords in browsers, share credentials through email or lack centralized controls over access to sensitive accounts.

These discoveries give MSPs a concrete business case for recommending additional protections, rather than introducing new security tools without a demonstrated need.

Where Keeper fits in

Keeper Password Manager provides MSPs with a centralized way to secure and manage client credentials while giving employees an encrypted vault for storing and sharing passwords and passkeys.

Through Keeper’s multi-tenant management console, MSPs can oversee every client organization, manage access and apply security policies without administering each client separately.

Keeper enables MSPs to: 

• Secure passwords and passkeys: Protect sensitive login information across supported business applications in encrypted vaults.
• Reduce risky credential practices: Replace spreadsheets, insecure sharing methods and weak or reused passwords.
• Strengthen administrative control: Apply Role-Based Access Controls (RBAC) and govern user permissions throughout the employee lifecycle.
• Simplify the employee experience: Use KeeperFill to generate and autofill strong passwords, reducing the effort required to access business applications securely.

For MSPs, integrating Keeper into their managed security offerings strengthens client protection, streamlines service delivery and unlocks new recurring revenue streams. 

How MSPs should prepare clients for the 2027 deadlines

1. Assess authentication readiness

Review Microsoft Entra authentication configurations to identify users who still rely on SMS or voice authentication. Microsoft’s PowerShell script can help identify affected accounts and determine the migration scope.

2. Prioritize clients and establish onboarding standards

Focus first on existing clients with the greatest dependence on legacy authentication methods, considering user volume, security exposure and migration complexity. For new clients, make phishing-resistant authentication and centralized credential management standard components of the onboarding process.

3. Plan and execute the migration

Select supported authentication methods based on each client’s requirements. Use Microsoft Entra registration campaigns to encourage passkey enrollment, provide instructions and monitor adoption. Account for device compatibility, recovery procedures and any need for third-party SMS or voice delivery.

4. Maintain security standards and leverage Keeper resources

Define repeatable policies for credential sharing, access permissions and employee offboarding. Incorporate periodic reviews to ensure these controls remain effective as client requirements change. Stay engaged with your Keeper representative, use available marketing resources to support client adoption and leverage Keeper’s sales engineers for ongoing technical training.

Turning Microsoft’s deadline into lasting security improvements

Microsoft’s retirement of SMS and voice authentication gives MSPs a clear deadline to prepare their clients, but the real value lies in the actions they take in the years ahead.

MSPs that act now can transform this mandatory transition into a competitive advantage, strengthening client relationships, expanding their security offerings and driving sustainable business growth.

Discover how Keeper Password Manager can help you protect client credentials, simplify administration and expand your managed security offerings.

If you have any questions about Microsoft’s upcoming authentication changes or how best to prepare your clients, feel free to contact us.