SMS MFA Retirement: A Construction Firm’s February 2027 Checklist

SMS MFA retirement is approaching for Microsoft work accounts, with an important deadline beginning February 1, 2027. For construction companies, that date could affect employees who currently use text-message or voice-call codes to sign in to Microsoft 365 and other applications connected to Microsoft Entra ID.

Imagine an estimator preparing to submit a bid. A superintendent needs updated drawings from SharePoint. An office manager is reviewing invoices, while a project manager is trying to access Teams from a jobsite trailer.

If those employees rely exclusively on Microsoft-provided text or voice authentication, an unplanned transition could create sign-in problems when the retirement takes effect.

Microsoft is moving organizations toward phishing-resistant authentication methods such as passkeys, Windows Hello for Business, and FIDO2 security keys.

The change is designed to improve account security, but businesses still need to prepare employees, devices, and support procedures.

For contractors, general contractors, subcontractors, and specialty trade companies, planning is especially important because employees may work across offices, jobsites, personal phones, shared tablets, and temporary project locations.

Da-Com IT Pros provides Managed IT Services and cybersecurity support for businesses throughout St. Louis, St. Charles County, the Metro East, and Southern Illinois.

In this guide, we explain Microsoft’s confirmed retirement timeline, how the change affects construction businesses, what sign-in alternatives are available, and how to prepare your team before February 1, 2027.

Quick Answer: What Is Microsoft’s SMS MFA Retirement?

Microsoft’s SMS MFA retirement is the scheduled removal of Microsoft-provided text-message and voice-call authentication delivery in Microsoft Entra ID. Beginning February 1, 2027, most affected users will no longer be able to rely on Microsoft’s native SMS or voice delivery to complete multifactor authentication. Global Administrators and external users follow a later July 1, 2027 deadline.

Organizations should identify affected users and move them to supported phishing-resistant methods before their applicable deadline.

Important details include:

• September 1, 2026: Microsoft began automatically enabling and encouraging passkey registration for eligible users configured for SMS or voice authentication.
• February 1, 2027: Microsoft-provided SMS and voice authentication is retired for most affected users, including internal guest users.
• July 1, 2027: The retirement extends to Global Administrators and external users.
• Passkeys: Microsoft recommends phishing-resistant authentication, including passkeys, Windows Hello for Business, and FIDO2 security keys.
• Limited telephony alternative: Organizations with a legitimate requirement to retain SMS or voice can explore supported third-party providers through Microsoft Security Store.

Microsoft states that affected users whose only available authentication method is SMS or voice will be required to register a passkey during sign-in after their applicable retirement date if an approved telephony alternative has not been configured.

That registration requirement can interrupt work if an employee lacks a compatible device, required permissions, or assistance.

Review Microsoft’s official SMS and voice authentication retirement documentation for the complete policy and implementation guidance.

Microsoft SMS MFA Retirement Timeline: Important 2026 and 2027 Dates

The retirement follows a phased schedule. Construction businesses should understand which employees fall under each date rather than assuming everyone has the same deadline.

Date	Microsoft Change	Recommended Business Action
September 1, 2026	Passkeys become the default direction for users enabled for SMS or voice, with registration prompts for eligible users.	Identify affected employees and communicate the upcoming change.
October 30, 2026	Microsoft’s rollout schedule includes options for organizations requiring supported third-party telephony delivery.	Have IT evaluate any documented business need to retain SMS or voice.
February 1, 2027	Microsoft-provided SMS and voice delivery retires for most affected users, including internal guest users.	Complete employee migration and test sign-in before the deadline.
July 1, 2027	Microsoft-provided SMS and voice delivery retires for Global Administrators and external users.	Complete remaining migrations, preferably well before this later date.

The February 2027 change applies to Microsoft’s public cloud environments under the published policy. Other cloud environments and Microsoft identity products may follow different schedules.

The retirement does not mean that all SMS authentication on every website or service will disappear.

It specifically concerns the affected Microsoft Entra ID authentication methods and Microsoft-provided delivery.

Microsoft provides additional answers in its SMS and voice retirement FAQ.

Why SMS MFA Retirement Matters for Construction Companies

Construction companies face challenges that are different from those of businesses where nearly every employee works at the same desk.

A contractor may have office employees, estimators, field superintendents, foremen, project engineers, executives, seasonal workers, and subcontractor contacts accessing the same Microsoft environment from different devices.

Field Crews Work Across Multiple Locations

Superintendents may sign in from job trailers, pickup trucks, temporary project offices, and active construction sites.

They may rely on Microsoft Teams, Outlook, SharePoint, or another connected application to review plans, communicate with project teams, and retrieve documents.

Some employees use company-issued phones, while others rely on personal devices.

That variation makes it important to test authentication methods in the environments where employees actually work.

Shared Tablets and Jobsite Computers Create Additional Questions

Some construction companies maintain shared tablets or computers for timecards, safety records, and drawings.

Passkeys are generally associated with individual identities and supported authenticators. A shared computer should not automatically mean employees share one Microsoft account or passkey.

Businesses should evaluate individually assigned accounts, supported shared-device configurations, and role-based access with their IT team.

This transition can provide an opportunity to improve accountability as well as authentication security.

Personal Phones and Employee Turnover Matter

Construction businesses may have seasonal employees, apprentices, temporary staff, and subcontractors working across projects.

Authentication planning should address compatible devices, personal-device policies, credential recovery, and employee offboarding.

When someone changes phones or leaves the organization, IT needs a dependable way to manage their account and registered authentication methods.

Project Deadlines Do Not Wait for Account Recovery

An estimator who cannot access a bid file, a superintendent who cannot retrieve plans, or an accountant who cannot enter a financial application may experience an immediate operational problem.

A planned migration helps reduce the chance that a predictable authentication change becomes an urgent help desk issue.

Why Is Microsoft Moving Away From Text-Message MFA?

SMS-based multifactor authentication is better than relying on a password alone, but it has limitations.

An attacker can create a convincing sign-in page, trick a user into entering their password, and then ask for the text-message verification code.

If the criminal uses that code quickly enough, the authentication step may be defeated.

Text-message authentication can also be vulnerable to SIM-swapping attacks, in which someone fraudulently transfers a telephone number to a different SIM or account.

Passkeys use a different approach.

Rather than requiring employees to type a reusable code into a website, passkeys use cryptographic credentials associated with an authenticator and the legitimate service.

Properly implemented passkeys can provide phishing-resistant authentication because the credential is bound to the intended service rather than a lookalike sign-in page.

The Cybersecurity and Infrastructure Security Agency’s MFA guidance encourages organizations to adopt phishing-resistant authentication where possible.

For construction companies, that protection matters because employees regularly receive invitations, project links, invoices, file-sharing requests, and other external communications.

A realistic phishing email may appear to reference a legitimate construction project, a familiar general contractor, or an upcoming deadline.

The move to phishing-resistant MFA reduces reliance on employees correctly identifying every malicious message.

Passkeys vs. SMS Codes vs. Security Keys: What Should Contractors Use?

Different groups within a construction business may need different authentication approaches.

Microsoft supports several phishing-resistant options, but the exact method depends on device compatibility, organizational policies, licensing, and configuration.

Authentication Method	How It Works	Potential Construction Use
SMS or voice codes	Delivers a code or verification call through a telephone service.	Being phased out as a Microsoft-provided Entra method on the applicable retirement dates.
Microsoft Authenticator passkey	Uses a supported mobile authenticator to complete phishing-resistant sign-in.	May fit field leaders with compatible company or approved personal phones.
Windows Hello for Business	Uses supported device-based credentials with PIN or biometric unlock.	May fit estimators, office employees, and project managers using managed Windows computers.
FIDO2 hardware security key	Uses a physical security key for supported authentication.	May help employees who cannot use a compatible phone or require a separate hardware authenticator.
Third-party telephony service	Provides supported SMS or voice delivery through a configured provider.	May be considered for documented requirements where the organization cannot move fully away from telephony methods.

These are planning examples, not universal assignments.

A construction company should test the proposed method with the actual devices, accounts, browser configurations, and applications used by each group.

Do Passkeys Require Biometric Authentication?

Not necessarily.

Depending on the authenticator, a passkey may be unlocked using a device PIN, fingerprint, facial recognition, or another supported local verification method.

Employees do not all need to use fingerprint or facial recognition to benefit from phishing-resistant authentication.

Do Employees Need to Buy New Phones?

Not automatically.

Some current phones support passkeys, while employees using older or incompatible devices may require a different method.

Businesses should inventory devices before purchasing replacements. Hardware security keys or managed work devices may be suitable alternatives for some users.

SMS MFA Retirement Checklist for Construction Companies

The following checklist is designed to help contractors prepare for the SMS MFA retirement without disrupting office work or jobsite operations.

Step 1: Identify Employees Still Using SMS or Voice

Begin by determining which users in your Microsoft Entra environment still depend on text messages or voice calls for authentication.

Microsoft’s retirement documentation provides administrative guidance for identifying active SMS and voice users.

Group the results by department or role:

• Executives and administrators.
• Accounting and office employees.
• Estimators.
• Project managers.
• Superintendents and field leaders.
• Other field employees.
• Internal guest users and relevant outside collaborators.

Pay particular attention to employees who have no other usable authentication method registered.

Step 2: Review Stale Accounts and Former Employee Access

Before migrating users, review accounts that should no longer exist or need access.

Construction firms often have people moving between projects, changing roles, or leaving after temporary assignments.

Remove access according to the organization’s approved offboarding process.

Da-Com’s Employee Offboarding Security Guide explains how organizations can identify lingering access across email, cloud services, applications, devices, and third-party integrations.

This cleanup can reduce the number of accounts that need migration while improving general account security.

Step 3: Choose an Authentication Method for Each Group

Do not assume the same authentication option will work for every employee.

Office personnel using managed Windows computers may have different requirements from superintendents using rugged tablets or foremen working primarily from mobile phones.

Review:

• Device compatibility.
• Required applications.
• Personal-device policies.
• Internet connectivity.
• Physical working conditions.
• Authentication recovery procedures.
• Employee accessibility needs.

Document which method each employee group will use before registration begins.

Step 4: Address Shared Jobsite Devices

Jobsite tablets and trailer computers deserve a separate review.

If employees share one device, determine how each person should authenticate using their own identity.

Do not automatically distribute one account or passkey among an entire crew.

Work with your IT team to evaluate supported device management and sign-in configurations.

Step 5: Pilot the New Process on One Project

Select a small group that represents actual construction work.

For example, include a superintendent, project manager, estimator, and employee who uses a shared jobsite device.

Have the group register its authentication methods and test common workflows.

Confirm access to:

• Outlook email.
• Microsoft Teams.
• SharePoint or OneDrive files.
• Project-related documents.
• Approved mobile applications.
• Any other relevant Microsoft Entra-connected applications.

Record problems and questions so the wider rollout can be improved.

Step 6: Communicate in Plain Language

A long email from IT may not reach everyone working in the field.

Construction companies should communicate through channels employees actually use.

Depending on the organization, that may include:

• Project meetings.
• Jobsite briefings.
• Superintendent communications.
• Office meetings.
• Short instructional handouts.
• Approved text or mobile communications.

Explain what is changing, what employees need to do, where to get help, and when they should complete registration.

A useful message might be: “Microsoft is changing how we verify work-account sign-ins. If you currently receive a text code, IT will help you set up a more secure method before February 1.”

Step 7: Schedule Registration Assistance

Employees should not be expected to discover device compatibility problems on the morning they need to access a critical project file.

Provide scheduled opportunities for registration and testing.

For office employees, that may involve a short support session. For field teams, it may involve planned jobsite assistance or coordination through project leadership.

Support staff should also explain what happens if employees lose a device, replace a phone, or need to recover their account.

Step 8: Evaluate Any Requirement to Retain SMS or Voice

Microsoft allows organizations with legitimate business, regulatory, or operational requirements to explore supported third-party telephony providers through Microsoft Security Store.

This is not the same as continuing to use Microsoft’s native SMS delivery after the deadline.

IT leadership should assess whether retaining telephony authentication is necessary, what the service would cost, and whether a phishing-resistant alternative is feasible.

Organizations should document the reason for any exception and review the applicable provider and policy requirements.

Step 9: Migrate Privileged Accounts Early

Global Administrators have a later July 1, 2027 retirement date, but that does not mean the organization should postpone protecting them.

Privileged accounts can provide substantial control over business systems and identities.

Companies should prioritize strong authentication and appropriate access controls for administrators well before the final deadline.

Step 10: Confirm Completion and Test Recovery

Before February 1, confirm that affected employees have registered supported methods and can complete real sign-ins.

Test account recovery procedures and establish a process for employees whose devices become unavailable.

Use administrative reporting to identify remaining accounts that still rely on Microsoft-provided SMS or voice.

The goal is to finish the migration before the retirement requires users to register during a time-sensitive login.

What Happens If Your Construction Company Does Nothing?

If a business takes no action, some employees may register passkeys in response to Microsoft’s existing prompts.

Others may continue using text or voice codes until the applicable retirement date.

Beginning February 1, 2027, affected users who rely only on Microsoft-provided SMS or voice and do not have an applicable telephony-provider arrangement will face a blocking passkey registration requirement when signing in.

That does not mean every user will permanently lose their account.

It does mean the authentication experience can be interrupted until registration is completed successfully.

For a construction business, that may be inconvenient at best and disruptive if it occurs immediately before an important bid, project meeting, payroll run, or document deadline.

Employees may also attempt unsafe workarounds, such as using another person’s account, when they do not understand how to recover access.

A planned rollout helps reduce these risks while providing a stronger foundation for identity security.

Can a Construction Company Keep SMS MFA After February 2027?

Possibly, through a supported third-party telephony provider and the required Microsoft configuration.

Microsoft’s published policy retires Microsoft-provided SMS and voice delivery, but it describes a supported path for organizations with legitimate requirements to retain those methods.

Before choosing that option, businesses should consider:

• Whether the requirement is genuinely necessary.
• Which users need the exception.
• Whether a phishing-resistant alternative is available.
• The applicable provider’s availability and pricing.
• Microsoft Entra policy configuration.
• Ongoing support and administrative responsibilities.

Microsoft states that there is no opt-out from the applicable retirement enforcement itself. The temporary opt-out for registration prompts does not eliminate the February or July deadline.

For details, review the official Microsoft retirement FAQ.

How Da-Com IT Pros Can Help With SMS MFA Retirement

For a construction company, an identity migration can involve more than enabling a new sign-in option.

The business may need to coordinate field employees, office users, mobile devices, account policies, guest access, administrator accounts, and employee training.

Da-Com IT Pros helps businesses evaluate technology security and plan changes through its Managed IT Services.

Microsoft 365 and Identity Planning

A managed IT discussion can help identify affected users, review identity configurations, and establish a migration plan appropriate to the organization’s Microsoft environment.

Actual implementation support depends on the selected services, licenses, technical requirements, and agreement.

Cybersecurity and Account Protection

Phishing-resistant MFA is one element of a broader cybersecurity plan.

Construction companies should also consider employee access, endpoint security, account monitoring, email protection, and incident response.

These responsibilities should be coordinated rather than addressed as unrelated projects.

Technology Success Program

Da-Com’s Technology Success Program focuses on helping businesses reduce technology-related risk and align IT decisions with business needs.

The SMS MFA retirement provides an example of a known technology change that can be planned before it becomes an operational interruption.

Virtual Chief Information Officer Services

Da-Com’s vCIO services can help leadership evaluate the timing, budget, device needs, and priorities associated with a technology transition.

Read Da-Com’s What Is a vCIO? Guide for an explanation of how strategic IT planning differs from daily help desk support.

Device and Employee Support

A contractor may need one authentication approach for an estimator using a Windows laptop and another for a superintendent using a field tablet.

Managed IT support can help the organization document device requirements, coordinate supported configurations, and prepare an employee support process.

Importantly, backup and disaster recovery services do not replace identity registration. They address different risks and should not be presented as a workaround for a user who has not completed authentication migration.

Common SMS MFA Retirement Mistakes to Avoid

Waiting Until February 1 to Begin Migration

Registration problems are easier to address when employees are not already blocked from an urgent task.

Assuming Every Employee Has a Compatible Smartphone

Review actual devices and accessibility needs. Some employees may need a different supported authenticator.

Using Shared Accounts to Avoid Individual Setup

Shared logins can make accountability and access management more difficult. Evaluate supported individual authentication and managed shared-device configurations.

Forgetting Internal Guest Users

Internal guest users remain within the February 1 retirement scope, while the later July 1 deadline applies to Global Administrators and external users.

Ignoring Administrative Accounts Until July

Privileged accounts deserve strong protection as early as possible, even when their official retirement date is later.

Confusing the Temporary Opt-Out With a Deadline Extension

Microsoft’s temporary enrollment opt-out does not remove the retirement requirement.

Sending Instructions Without Providing Support

Employees working from jobsites may need short, practical assistance and tested recovery instructions, not only a long email describing the policy.

SMS MFA Retirement Readiness Checklist

Use this checklist to guide your construction company’s planning.

• Confirm whether your Microsoft Entra environment is affected.
• Identify active SMS and voice authentication users.
• Separate office staff, field workers, administrators, and guests.
• Review device and authenticator compatibility.
• Remove unnecessary former employee access.
• Identify shared-account and shared-device concerns.
• Select supported phishing-resistant authentication methods.
• Pilot registration with a representative project team.
• Test Outlook, Teams, SharePoint, and relevant applications.
• Communicate the change through office and jobsite channels.
• Provide practical registration assistance.
• Document account recovery procedures.
• Review any justified telephony exceptions.
• Protect Global Administrator accounts early.
• Confirm registration completion before February 1, 2027.
• Recheck Microsoft’s published guidance before the deadline for any updates.

Frequently Asked Questions About SMS MFA Retirement

When is Microsoft retiring SMS MFA?

Microsoft-provided SMS and voice authentication is scheduled to retire for most affected Microsoft Entra ID users on February 1, 2027. Global Administrators and external users have a later July 1, 2027 deadline. Internal guest users remain in the February group.

Will Microsoft 365 text-message codes stop working?

For affected users, Microsoft’s native SMS and voice delivery will no longer be available after the applicable retirement date. Organizations with a legitimate requirement may configure supported third-party telephony delivery through Microsoft Security Store.

Will employees be locked out of Microsoft 365?

Employees relying only on the retired Microsoft-provided methods may encounter a blocking passkey registration prompt before continuing. Whether they can complete registration smoothly depends on their environment, compatible authenticators, policies, and support arrangements.

What is a passkey?

A passkey is a cryptographic credential used for sign-in. Supported passkeys can provide phishing-resistant authentication without requiring the user to type a text-message verification code into a website.

Are passkeys more secure than SMS authentication?

Properly implemented passkeys are designed to resist phishing and common attacks against text-message codes. SMS-based MFA still offers more protection than passwords alone, but Microsoft is moving affected users toward stronger authentication methods.

Do construction employees need fingerprints to use passkeys?

No. Depending on the authenticator, supported local verification may use a PIN, fingerprint, facial recognition, or another method.

Can employees use FIDO2 security keys instead of smartphones?

FIDO2 hardware security keys are a supported phishing-resistant authentication option in appropriate Microsoft Entra configurations. Businesses should confirm compatibility, policies, and recovery procedures before deployment.

Does this retirement affect personal Microsoft accounts?

The published timeline discussed here concerns Microsoft-provided SMS and voice authentication in affected Microsoft Entra ID environments, particularly work and organizational identities. It should not be treated as a universal retirement of text authentication across every Microsoft product.

Can businesses delay the SMS MFA retirement?

Microsoft describes a temporary opt-out from certain automatic passkey-enablement and registration prompts, but not from the retirement enforcement dates. Organizations needing continued telephony authentication should evaluate the supported third-party provider option.

Can Da-Com IT Pros help construction firms prepare?

Da-Com IT Pros provides managed IT, cybersecurity, identity-related support, and strategic technology guidance for businesses in the St. Louis region and Southern Illinois. Contact Da-Com to discuss an assessment of your Microsoft environment, affected users, devices, and migration support needs.

Prepare Your Construction Team Before February 1, 2027

The SMS MFA retirement is a significant Microsoft identity change, but it is also an opportunity for construction businesses to strengthen account security and improve their employee sign-in processes.

Instead of waiting for an estimator, superintendent, project manager, or accounting employee to encounter a registration requirement during a busy workday, companies can prepare now.

Start by identifying affected users, selecting appropriate authentication methods, testing common applications, and making sure employees know where to get help.

Da-Com IT Pros works with construction companies, subcontractors, and specialty trades throughout St. Louis, St. Charles, Chesterfield, O’Fallon, the Metro East, Belleville, Edwardsville, Collinsville, and Southern Illinois.

Our team can help businesses discuss:

• Microsoft 365 account and identity management.
• Authentication migration planning.
• Passkeys and phishing-resistant MFA.
• Office and field device support.
• Cybersecurity risk reduction.
• Employee access and offboarding.
• Technology Success planning.
• Virtual CIO guidance.

The right plan should reflect the employees, devices, systems, and project schedules your company actually depends on.

Contact Da-Com IT Pros today to discuss preparing your construction company for Microsoft’s February 2027 authentication changes.

Explore Da-Com’s Managed IT Services, Employee Offboarding Security Guide, and vCIO Technology Planning Guide for additional resources to support a more secure and reliable business technology environment.