```
Microsoft has again reminded administrators of its Entra ID identity platform that SMS and voice call authentication methods will be retired in February 2027, and that users still relying on them at the cut-off face disrupted sign-in. With the date fixed and only about four months left on the clock, the reminder is best read as a countdown: the migration work is now a scheduled project with an end date, not an open-ended recommendation.
BleepingComputer relayed the reminder, reporting that Microsoft is urging admins to move users onto methods Microsoft classes as phishing-resistant, including passkeys and FIDO2 security keys, before the retirement takes effect. The report does not date the latest notice or identify the channel it arrived through — an admin-center banner, a Microsoft message-center post, or a documentation update — so this story should be treated as a reminder of a known deadline rather than a fresh announcement.
The repeated nature of the outreach is itself notable. Microsoft has issued this nudge more than once, which — as an interpretive reading rather than a stated company position — suggests adoption of phishing-resistant methods is moving slower than the deadline requires. Admins who have filed earlier reminders away as informational may want to treat this one as a scheduling trigger.
Why SMS and voice are on the way out
SMS one-time passcodes and voice-call codes can be intercepted through SIM-swapping, SS7-signalling attacks, and real-time OTP relay phishing, where a proxy forwards a live code to the attacker. Passkeys and FIDO2 keys bind the credential to the origin instead, so an interceptor has nothing reusable to replay.
A countdown checklist for admins
- Inventory current methods. Review the Authentication Methods policy in Entra ID and identify every user still enabled for SMS or voice.
- Prioritise high-risk and high-privilege accounts. Administrators and executives should move first.
- Enrol passkeys and FIDO2 keys. Confirm users have a registered phishing-resistant method before removing the legacy option — migration order matters more than the switch itself.
- Rehearse the failure path. Test what happens to a user whose only registered method is SMS, so support teams recognise the disruption rather than treat it as an outage.
- Communicate internally and to customers. Any service that assumes an SMS or voice OTP will be delivered needs a documented alternative before February 2027.
One scope caveat belongs in every migration plan: admins should confirm against Microsoft's own Entra ID authentication methods documentation exactly which methods are Microsoft-managed versus third-party, and whether any accounts — emergency or break-glass access in particular — are treated differently, before locking the removal step.
For teams in Hong Kong and Macau, one general observation applies: where sign-in flows or customer-facing processes assume SMS OTP delivery to local mobile numbers, those dependencies should be surfaced and reviewed now rather than discovered at cut-off. The retirement is platform-wide, so the deadline applies regardless of where the numbers are issued.
The practical takeaway is a scheduling one: February 2027 is fixed, the affected population is enumerable today inside the admin portal, and the work required — inventory, enrolment, removal, communication — is ordinary but not instant. Teams that begin now have room for a staged rollout; teams that push the work into 2027 will be doing it under deadline pressure.
```
Microsoft 再次提醒其 Entra ID 身份平台的管理員，SMS 及語音通話認證方式將於 2027 年 2 月停用，屆時仍然依賴這些方式的用戶將面臨登入中斷。限期既已確定，距離截止只剩約四個月，這項提醒最好視為倒數計時：遷移工作現已是有明確截止日期的既定項目，而非無限期的建議。
BleepingComputer 轉述了這項提醒，報導 Microsoft 正敦促管理員在停用生效前，將用戶遷移至 Microsoft 歸類為抗釣魚（phishing-resistant）的認證方式，包括 passkeys 及 FIDO2 security keys。該報導並未注明最新通知的日期，也未說明通知透過何種渠道發出——是管理中心橫幅、Microsoft message center 公告，還是文件更新——因此本文應視為對已知限期的再次提醒，而非新公布的公告。
此類提醒一再重複本身值得注意。Microsoft 已不止一次發出此類提示——以下為詮釋性解讀，並非公司正式立場——這反映抗釣魚認證方式的採用進度比限期要求的為慢。先前已將提醒歸檔作一般資訊的管理員，本次或應將其視為排程觸發點。
為何 SMS 及語音認證將被淘汰
SMS 一次性密碼（one-time passcodes）及語音通話驗證碼可透過 SIM swapping（SIM 卡劫持）、SS7 信令攻擊，以及即時 OTP 轉發釣魚（real-time OTP relay phishing）被截取——後者由代理人將即時密碼轉發予攻擊者。Passkeys 及 FIDO2 keys 則將憑證綁定至來源網站（origin），截取者並無可重用的內容可供重放（replay）。
管理員倒數清單
- 盤點現有認證方式。 檢視 Entra ID 的 Authentication Methods 政策，找出所有仍啟用 SMS 或語音認證的用戶。
- 優先處理高風險及高權限帳戶。 管理員及高層應率先遷移。
- 註冊 passkeys 及 FIDO2 keys。 在移除舊有選項前，先確認用戶已登記抗釣魚認證方式——遷移次序比切換本身更為重要。
- 預演失敗路徑。 測試僅登記 SMS 一種方式的用戶會出現甚麼情況，讓支援團隊能識別此類中斷，而非誤當作系統故障（outage）。
- 對內及對客戶作出溝通。 任何依賴 SMS 或語音 OTP 送達的服務，須在 2027 年 2 月前制訂已記錄在案的替代方案。
每項遷移計劃都應加入一項範圍說明：管理員在確定移除步驟前，應根據 Microsoft 自身的 Entra ID authentication methods 文件，核實哪些方式由 Microsoft 管理、哪些屬第三方管理，以及是否有任何帳戶——尤其是緊急（emergency）或 break-glass access 帳戶——會獲特殊處理。
對於香港及澳門的團隊，有一點普遍觀察適用：凡登入流程或面向客戶的流程假設 SMS OTP 會送達本地手機號碼，相關依賴項目應即時梳理及檢視，而非等到截止日期才發覺。停用屬平台層面的全面安排，限期適用於所有地區，不論號碼在哪裏發出。
實際上的重點關乎排程：2027 年 2 月限期已定，受影響用戶群體今日已可在管理中心 portal 內逐一列舉，而所需工作——盤點、註冊、移除、溝通——並非繁複，但也無法一蹴而就。現已開始的團隊尚有餘裕分階段推行；將工作延至 2027 年才動手的團隊，將在限期壓力下趕工。