(Updated) Microsoft Entra ID: Retirement of SMS first-factor sign-in for Entra ID Free tenants

🚨 The Signal: Microsoft Entra ID Free tenants will lose SMS first-factor sign-in on August 11, 2026, due to high fraud risk. This change enhances security by removing a vulnerable authentication method, forcing users to adopt stronger, phishing-resistant alternatives.

The Impact

Entra ID Free tenants using SMS for first-factor sign-in are affected, reducing their risk of account compromise.

• Entra ID Free tenants: Enhanced security posture by removing a vulnerable sign-in method.
• Users relying on SMS first-factor: Will need to switch to more secure authentication methods.
• Security teams: Reduced attack surface from SMS-based phishing and account takeover attempts.

The Action

1. Identify users in Entra ID Free tenants currently using SMS first-factor sign-in.
2. Communicate the change to affected users, providing guidance on alternative authentication methods.
3. Assist users in registering for stronger authentication methods (e.g., Microsoft Authenticator, FIDO2 security keys).
4. Monitor sign-in logs for any authentication failures related to this change post-August 2026.

Domain: Entra · Impact: high · Workload: Entra ID · Essential Eight: Multi-Factor Authentication · ISM: ISM-0109, ISM-0123, ISM-0140, ISM-0974, ISM-1173, ISM-1228, ISM-1401, ISM-1504, ISM-1505, ISM-1679, ISM-1680, ISM-1681, ISM-1682, ISM-1683, ISM-1815, ISM-1819, ISM-1872, ISM-1873, ISM-1874, ISM-1892, ISM-1893, ISM-1894, ISM-1906, ISM-1907