SSPR with SMS/Voice retirement

Adding two details that catch people out when they replace SMS in SSPR.

Yes, SSPR is included: the FAQ says the retirement of native SMS and voice "applies across Microsoft Entra, including SSPR" (unless you use a telephony provider through Microsoft Security Store).

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement-faq

1. Passkeys don't help SSPR. The SSPR methods are Microsoft Authenticator push, software OATH tokens, hardware OATH tokens (preview), SMS, voice call and email OTP. Passkeys and Windows Hello aren't on the list, so a user who moves from SMS to a passkey for sign-in still needs a separate SSPR method. (Microsoft says it plans to add password change for users who sign in passwordless, with "more details to come".) https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks
2. If your SSPR policy requires two methods: Authenticator, software OATH and hardware OATH count as one method for SSPR. A user with Authenticator plus a TOTP app has one SSPR method, not two. Also, Authenticator can't be the only enabled method when one is required. So when SMS goes, most tenants need email OTP (or another non-phone method) enabled as the second SSPR method.

What I'd check now:

• SSPR policy: how many methods are required, and which are enabled.
• The user registration report (isSsprCapable / isSsprRegistered, or Entra admin center → Authentication methods → User registration details) for users whose SSPR methods are only phone numbers.
• Admin accounts use the fixed two-gate admin policy, so give admins a pair that doesn't rely on SMS or voice.

Yep - the retirement of Microsoft's native SMS and voice capabilities applies across Microsoft Entra ID, including SSPR. In the legacy SSPR settings, Mobile phone corresponds to SMS and voice calls, while Office phone corresponds to voice calls. The legacy MFA and SSPR policy controls also stopped being available for managing authentication methods after September 30, 2025, so SSPR should now be managed through the Authentication methods policy.

For SSPR, the recommended approach is to move users away from SMS and voice and configure supported authentication methods through the Authentication methods policy. Microsoft Authenticator is a primary alternative, while Email OTP can provide another supported recovery option. Other stronger, phishing-resistant methods can also be used where appropriate.

If your organization must continue using SMS or voice for business, regulatory, or operational reasons, it can use a customer-managed telecom provider through the Microsoft Security Store instead of Microsoft's native SMS and voice service.

The deadline is February 1, 2027, when Microsoft-provided SMS and voice capabilities are retired in Entra ID. You should complete the transition before that date to avoid disruptions to authentication and password reset. If a user reaches that point with SMS or voice as their only available MFA method, they will be required to register a passkey during sign-in before they can continue.

There is also a separate SSPR change coming in March 2027, when security questions are retired. The long-term approach for SSPR is therefore to configure supported authentication methods through the Authentication methods policy rather than relying on SMS, voice calls, or security questions.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin