Body
UM System is continuing its transition toward stronger, phishing-resistant multifactor (prMFA) authentication methods to better protect university accounts, institutional data, and information technology resources.
This transition is being driven by both Microsoft's retirement of legacy authentication services and the university's broader cybersecurity objectives.
Microsoft has announced that it will retire Microsoft-provided SMS and voice authentication beginning February 1, 2027, for most users, with the remaining affected user populations transitioning July 1, 2027. Microsoft is moving toward passkeys and other phishing-resistant multifactor authentication methods as the preferred approach to protecting accounts. Additional details are available in the Microsoft Entra SMS and Voice Authentication Retirement Timeline.
UM System is taking a proactive approach by establishing its own deadlines for transitioning away from these methods. This will allow us to assist users, address accessibility and operational concerns, and reduce the likelihood of authentication disruptions as Microsoft's changes take effect.
The security reasons for this transition are significant. Voice calls and SMS text messages are vulnerable to phishing, social engineering, SIM swapping, telephone number compromise, and interception of authentication codes. These methods do not adequately protect against modern phishing attacks in which users are tricked into providing authentication codes to malicious websites.
Our direction is to move away from multifactor authentication methods vulnerable to phishing and toward methods that provide stronger assurance of a user's identity. While Microsoft Authenticator push notifications offer improvements over voice and SMS, they are not considered phishing-resistant. Our longer-term objective is the adoption of phishing-resistant authentication methods, including Microsoft Authenticator passkeys and FIDO2 security keys (YubiKeys).
Key Deadlines
UM System transition deadlines:
-
December 1, 2026: Voice phone-call multifactor authentication will no longer be available.
-
July 1, 2027: SMS text-message multifactor authentication will no longer be available.
Microsoft retirement deadlines:
-
February 1, 2027: Microsoft-provided SMS and voice multifactor authentication will be retired for most users, including internal guest users.
-
July 1, 2027: Microsoft-provided SMS and voice multifactor authentication will be retired for Global Administrators and external users.
Microsoft's retirement applies to its native telephone authentication delivery. Organizations with a continuing business or operational requirement may use a supported third-party telephony provider. UM System's transition deadlines establish when these authentication methods will no longer be available under the university's planned implementation.
Communication and Transition Plan
The first targeted communication to users who have used voice authentication within the last 90 days will be sent today, Thursday, November 5.
Follow-up communications will continue through December 1 to ensure affected users understand the changes and have an opportunity to establish an alternative authentication method before voice authentication is disabled.
Following the voice authentication transition, communications will shift toward preparing users for the July 1, 2027, SMS retirement.
Approximately 14,000 users system-wide have used voice authentication within the last 90 days. However, more than half of those users have used the method only once or twice during that period. This suggests that many affected users may already have an alternative authentication method available.
Expectations for IT Staff
IT staff should be prepared to explain the security reasons for these changes, assist users with transitioning to supported authentication methods, and reinforce the university's direction toward phishing-resistant authentication.
When assisting users, staff should encourage the adoption of phishing-resistant authentication methods wherever practical rather than simply replacing one legacy authentication method with another.
Users should be encouraged to register at least two independent phishing-resistant authentication methods. This provides a backup if a device is lost, damaged, replaced, or otherwise unavailable. Examples include:
-
Microsoft Authenticator passkeys registered on two separate devices.
-
Two separate FIDO2 security keys (YubiKeys).
-
A Microsoft Authenticator passkey on a smartphone and a separate FIDO2 security key.
The objective is to avoid a single point of failure that could prevent users from accessing their accounts.
Users are not required to use a personal smartphone to meet the university's authentication requirements. FIDO2 security keys provide an alternative phishing-resistant authentication method for users who cannot or do not wish to use a smartphone.
Users who rely on voice or SMS authentication should be encouraged to complete their transition before the applicable deadlines to avoid interruptions in access to university services.
Account Recovery and Lost Authentication Devices
Users should be encouraged to maintain two independent authentication methods to minimize the risk of being locked out of their accounts.
If a user loses their phone, security key, or other authentication device and can no longer authenticate, IT staff should follow the established identity-verification and account-recovery process.
For Missouri S&T users, the following process applies:
-
Identity verification: Direct the user to the IT Walk-in Center in the library for in-person identity verification. This step is required before requesting an MFA exception to ensure the individual requesting account access is the legitimate account holder.
-
Ticket escalation: Once identity verification has been completed, route the ticket to the IT Security Operations team. The ticket should be classified as an Identity and Access Management (IdAM) request.
-
Document the situation: Include an explanation of the circumstances, the authentication methods that are no longer available, and confirmation that the user's identity was verified in person.
-
Request a temporary MFA exception: Ask IT Security Operations to review the request for a temporary MFA exception. When appropriate, Security Operations can temporarily add the user to an approved exception group for a maximum of five calendar days to allow them to regain access to their account.
-
Restore secure authentication: The user must re-establish a supported authentication method within the five-day exception period. This may involve restoring Microsoft Authenticator on a replacement phone or obtaining a FIDO2 security key, which costs approximately $30. Preferably, the user should establish both methods to reduce the likelihood of future account lockouts.
Temporary MFA exceptions are intended solely to facilitate account recovery and are not a permanent alternative to the university's authentication requirements. The exception will be removed when authentication is restored or when the five-day period expires, whichever occurs first.
IT staff should not bypass identity verification or independently grant MFA exceptions outside the established process.
Communication Resources
The following resources are available to assist IT staff and users:
-
Microsoft Entra – SMS and Voice Authentication Retirement Timeline — Microsoft's official retirement schedule, affected user populations, and guidance for transitioning away from SMS and voice authentication.
-
Talking points for IT staff — Guidance for answering questions, explaining the transition, and directing users to setup and support resources.
-
First targeted user communication — The initial message being sent to affected voice authentication users on November 5.
-
MFA Changes Website — UM System information regarding the retirement of voice and SMS authentication, supported authentication methods, and transition resources.
-
Microsoft Authenticator Passkey Setup – UM System Knowledge Base — Step-by-step instructions for configuring a passkey in Microsoft Authenticator, enabling users to adopt phishing-resistant authentication rather than traditional push notifications, SMS, or voice authentication.
-
Setting Up Security Keys (YubiKeys) for Windows and macOS – UM System Knowledge Base — Step-by-step instructions for configuring FIDO2 security keys (YubiKeys) on Windows and macOS devices, providing users with a phishing-resistant authentication option that does not require a smartphone.
Exceptions and Escalation
If a user requests an exception or is unable to transition to a supported authentication method, please escalate the request through a TDX ticket to the IT Security Operations team for review.
Exceptions will be evaluated individually based on documented accessibility, technical, or operational requirements. Approval of an exception does not guarantee continued availability of an authentication method that Microsoft has retired.
Temporary MFA exceptions granted for account recovery will be limited to a maximum of five calendar days. Users must establish a supported authentication method within that period. The exception will be removed when authentication is restored or when the five-day period expires, whichever occurs first. Extensions require a new review and approval by IT Security Operations.
Immediate Priority
Our immediate priority is ensuring that affected users understand the December 1, 2026, voice authentication deadline and have the support necessary to transition before that date.
IT staff should be familiar with the available authentication alternatives, encourage users to register two independent authentication methods, and be prepared to assist users who experience difficulties with the transition.
Additional information will be provided as we approach the SMS retirement deadline in July 2027.