SMS and voice are going as MFA in Microsoft 365

⏱ Reading time: ± 6 minutes

On 1 February 2027, Microsoft will stop sending SMS and phone codes for signing in to Microsoft 365 and Entra. Passkeys are becoming the norm. After that date, the old method will no longer work.

Don't panic: you have plenty of time. But it pays to understand what's happening now, so that nobody on your team ends up locked out later on.

What exactly is changing?

Many businesses today protect their Microsoft 365 with an extra step after the password. Often that's a code sent by text message or a phone call. This is known as multi-factor authentication, or MFA for short.

Microsoft is ending both of those methods. In practice:

• From 1 September 2026, passkeys become the default way to sign in. Users who currently rely on SMS or phone will automatically be asked to set up a passkey.
• From 1 February 2027, Microsoft itself will no longer send SMS or voice codes. Anyone who has only that method by then will see a mandatory screen at sign-in asking them to set up a passkey first. Only then can they carry on.

Important: there is no exception and no way to opt out of that requirement on 1 February 2027. It applies to every organisation.

Already using something other than SMS or phone today, such as the Microsoft Authenticator app, Windows Hello or a physical security key? Then you can simply keep using it. Very little changes for you.

Why is Microsoft doing this?

The reason is security. For years, a code by text message seemed safe, but attackers have since found ways around it. They intercept messages, hijack phone numbers through what's known as SIM swapping, or lure people to a fake page that passes the code straight on.

That last one, phishing, has become far more dangerous in recent years. Attackers now use artificial intelligence to create convincing fake emails and fake screens. According to figures cited by Microsoft, up to 54% of people click through on an AI-generated phishing email, compared with around 12% for traditional phishing. (Source: Microsoft Security Blog, 2026) An SMS code won't stop a targeted attack like that.

What is a passkey?

A passkey is a way of signing in without a password and without a code. Instead, you confirm who you are with something you already have: your fingerprint, your face or your device PIN. Think of how you unlock your banking app or your phone today.

Behind the scenes, it uses a digital key that is tied to Microsoft's real website. If an attacker tries a fake site, the passkey simply refuses to work, because the key doesn't recognise the fake page. So there's nothing to intercept or hand over, as there's no code for you to type in anywhere.

For the user, it's often quicker and easier than waiting for a text message, too. Unlock your device and you're done.

Passkeys can be stored in different places:

• In a password manager: a separate app that stores your passkeys and passwords securely and syncs them across all your devices.
• In an app or on your device: for example in the Microsoft Authenticator app, in Windows Hello, or in Apple's or Google's built-in storage.
• On a separate key: a small physical stick (a FIDO2 key) that you plug into your computer or hold against your phone.

Where should you keep your passkeys? Choose a good password manager.

This is the question that makes the biggest difference in the long run. A passkey is only as convenient as the place where it's stored.

Does everyone in your business use Apple devices? Then Apple's built-in storage (Keychain) is perfectly fine. It works smoothly and syncs neatly between iPhone, iPad and Mac.

Once you're running a business, though, that model soon hits its limits:

• You don't work with Apple alone. Most SMEs have a mix of Windows computers, Android phones and sometimes Apple. Apple's Keychain stops at the edge of the Apple ecosystem.
• You want to be able to share passkeys. Think of a shared login for your accounting software or a social media account. With a proper password manager, you can share these securely within a team, without sending passwords by email or chat.

For a business, a separate password manager is therefore almost always the better choice. It works on every device, lets you share securely and gives you an overview of who has access to what.

What does this mean for your business?

That depends on how you sign in today. This timeline will help you get your bearings:

1. 1

   1 September 2026

   Passkeys become the default. SMS and phone users are asked to set one up.

2. 2

   18 September 2026

   Microsoft announces which external telecoms providers may continue to deliver SMS, for those who genuinely need it.

3. 3

   30 October 2026

   Businesses that insist on keeping SMS can set up a provider. This comes at a cost.

4. 4

   1 February 2027 Deadline

   Microsoft's SMS and phone codes stop. Anyone who has only that method must set up a passkey.

For most SMEs, the message is simple: move your people over to passkeys, and this change is nothing to worry about. Setting up passkeys for your employees costs nothing extra with Microsoft. Only those who want to use an external SMS provider pay for it.

What should you do now?

You have until early 2027, but leaving it to the last minute isn't wise. A phased approach means nobody finds themselves locked out one morning.

Does your business have a genuine reason to keep SMS, for example strict regulations in your sector? Then you have the option of working through an external provider. For most SMEs that isn't necessary, and passkeys are the better and cheaper choice.

Frequently asked questions

Sources

• Passkeys by default and retirement of Microsoft-provided SMS and voice authentication, Microsoft Learn
• Passkeys are the default authentication method in Entra ID, Microsoft Security Blog
• MC1426371, Microsoft 365 Message Center