What happens to users if we turn off SMS MFA in Entra?

Once SMS is disabled, users cannot use it to satisfy MFA. Someone with no other usable method can be unable to complete sign-in, so don't count on a registration prompt rescuing them at that point.

Check the full list of registered methods, not just the default. Someone whose default is SMS but who also has Authenticator registered has another potential way in, provided it's allowed by your policies and they can still access it. Test what they're offered rather than assuming the default will switch automatically.

I'd run a registration campaign before switching SMS off and warn the people who only have a phone method registered. Review the Entra authentication methods report to find them, then test the change with a small group before widening it.

Have an alternative ready for people who can't or won't use a personal phone, such as a FIDO2 security key or a company device. Also plan how the help desk will restore access if someone loses their authenticator device.

Check password reset separately. Disabling SMS as an authentication method can affect self-service password reset as well as sign-in, and the number and types of methods required depend on your configuration.

If you want to stop SMS for sign-in but retain it for password reset, look at authentication strengths rather than simply disabling the method everywhere. Test that against your actual policies before rolling it out.

The SMS and voice retirement is a separate question from an admin turning SMS off today. Microsoft's guidance describes passkeys becoming the default authentication experience and being enabled for users who are enabled for SMS or voice from September 1, 2026.

That doesn't settle exactly which users will see a registration prompt or whether an existing Authenticator registration avoids it. Check the current guidance and test your tenant. I wouldn't treat a prompt or an automatic change of default method as guaranteed.