Microsoft Is Retiring SMS Login Codes: What Happens Next
In eleven days, Microsoft starts changing how your staff sign in to Microsoft 365. Nobody at your business has to click anything, approve anything, or agree to anything for it to happen.
On September 1, 2026, Microsoft Entra ID begins automatically enabling passkeys for every user still set up to receive a multifactor authentication code by text message or phone call. Five months later, on February 1, 2027, Microsoft stops sending those codes at all. If a text message is the only second factor an employee has at that point, they hit a blocking prompt at sign-in: register a passkey, or go no further.
This one is not a recommendation Microsoft is floating. It is a dated change with an announced enforcement point and no opt-out at the far end. Here is what happens, how to tell whether it touches your business, and what a small team should do with the runway that is left.
What Actually Changes, and When
There are two separate events, and conflating them is the most common way businesses get caught off guard. The first is a nudge. The second is a wall.
September 1, 2026. Any user enabled for SMS or voice in your Entra Authentication Methods Policy, or in legacy MFA settings, gets auto-enabled for passkeys. Microsoft also flips your Registration Campaign settings to a Microsoft-managed state that targets passkeys and pulls those users into scope. The next time one of them signs in and completes MFA, they see a prompt asking them to register a passkey. By default they can snooze it, and they can keep snoozing it.
February 1, 2027. Microsoft-provided SMS and voice delivery retires. According to Microsoft Learn, users whose only available MFA method is SMS or voice will be required to register a passkey during sign-in before they can continue, and that prompt is blocking. Microsoft states plainly that there is no opt-out from this behavior and that it applies to every tenant.
There is a temporary opt-out, but read what it covers. It delays the September 1 passkey enablement and the registration campaign while you finish your transition. It does nothing about February 1. Setting it buys quiet, not exemption.
Two dates in between matter if you have a regulatory reason to keep phone-based codes. Beginning September 18, 2026, Microsoft publishes information about telecom providers in the Microsoft Security Store. Beginning October 30, 2026, you can actually select and configure one.
Why Text Message Codes Are Going Away
The six-digit text has been the default second factor for a decade for one reason: everyone has a phone. Security was never the argument. Coverage was.
The problem is that a code sent to a phone is a shared secret, and shared secrets can be handed to the wrong person. SIM swap fraud moves the number to an attacker's device. A convincing phishing page collects the password and the code together, then replays both against the real login within seconds. The code being fresh does not help when the attacker is using it in real time.
A passkey behaves differently because there is no code to hand over. The credential is a cryptographic key pair bound to the site it was created for, so a lookalike domain gets nothing usable. There is no digit sequence for a caller to talk out of an employee, and nothing for a fake login page to capture.
We covered a live example of this gap in a recent post on device code phishing, where the attacker never builds a fake page at all and the usual advice about checking the URL falls apart. Text-message MFA does not stop that attack. A passkey does.
How to Tell If Your Business Is Affected
If your team signs in to Microsoft 365 and anyone gets a code by text or an automated call, you are affected. That covers a lot of small offices, because SMS is what most people picked when MFA was first switched on and nobody revisited it.
The tenant-level answer takes a few minutes. Microsoft published a PowerShell script on GitHub that reports which users are currently enabled for SMS or voice. Running it requires Global Reader, Authentication Policy Administrator, or Security Reader permissions. Do this before you plan anything, because the list is usually shorter than owners expect and longer than they hope.
The retirement also reaches past sign-in. It applies across Entra, including self-service password reset, so any staff member whose password recovery path is a text message needs a new path too.
If you are not sure who holds the admin roles at your business, or the last person who set up Microsoft 365 for you is no longer around, that is a separate problem this deadline is about to expose. Our support team runs this check for clients who would rather not go digging through the Entra admin center.
What Passkeys Look Like for a Small Team
The word sounds more exotic than the experience. For most people a passkey means their laptop or phone asks for Face ID, Touch ID, or a PIN, and sign-in completes. There is no app to open and no digits to type.
Entra ID supports two flavors, and the distinction shapes your rollout:
- Synced passkeys live in a platform credential manager such as iCloud Keychain or Google Password Manager and follow the user across their devices. This is the low-friction option for a team already living in one ecosystem, and it survives a lost phone.
- Device-bound passkeys stay on one piece of hardware: a passkey in Microsoft Authenticator, an Entra passkey on Windows, or a physical FIDO2 security key. Tighter control, more administrative overhead, and a real recovery plan required before you deploy them.
For a five to twenty person office with no dedicated IT staff, synced passkeys are usually the right starting point. Hardware keys make sense for the handful of accounts that would hurt most if they were taken: the owner, whoever moves money, and anyone holding global admin.
The part that determines whether this goes smoothly has nothing to do with technology. It is whether your staff know the prompt is coming and know it is legitimate. A passkey nudge that appears with no warning looks exactly like a phishing attempt to a well-trained employee, which is the outcome you spent money creating. Brief the team first. If security awareness is something you have been meaning to formalize, our training engagements are built for exactly this kind of change.
Your Next Eleven Days, and the Five Months After
The September date is soft. February is not. Treat the next five months as the project window and the next eleven days as preparation.
- Inventory who is on SMS or voice. Run the script or have someone run it for you. Put the affected users in a security group so you can target them later.
- Decide your default method now. Synced passkeys for most staff, device-bound for privileged accounts. Making this call once beats making it forty times at the help desk.
- Tell your people before September 1. One short email explaining what the prompt is, when it will appear, and that it is real. Microsoft offers communication templates if you want a starting draft.
- Run a small pilot. Two or three willing users, one week. You will find the device that will not cooperate, and you would rather find it in September than in January.
- Register passkeys for privileged accounts first. Global admins should not be the last group to migrate.
- Set a completion date in December. Not February. Leave room for the accounts you forgot about, and there will be some.
The businesses that will have a bad February are the ones that read about this in January. Deadlines like this are ordinary infrastructure work, and they arrive on a schedule you can plan around when someone is watching for them. That watching is the substance of what a vCIO engagement provides.
If You Have to Keep SMS
Some businesses have a defensible reason. A compliance regime that names out-of-band SMS, or a workforce where no other method is workable, are the cases Microsoft designed the escape hatch for.
The escape hatch is bringing your own telecom provider through the Microsoft Security Store. Microsoft's retirement FAQ confirms this carries a per-message cost that varies by provider, region, and volume, while migrating those same users to passkeys costs nothing extra.
Document the requirement before you go down this road: which regulation, which scenario, which users. Then scope it to those users only and default everyone else to passkeys. Paying a carrier to preserve the weakest method in your stack for staff who never needed it is a bill with no return.
Frequently Asked Questions (FAQs)
Q: Will my employees be locked out of their accounts on February 1, 2027?
A: Not locked out, but blocked at the door until they act. A user whose only MFA method is SMS or voice will get a prompt requiring them to register a passkey before sign-in completes. They can do it on the spot if they have a compatible device with them. The risk is that this happens to several people on the same morning with no warning, which turns a two-minute task into a lost hour.
Q: Does this affect personal Microsoft accounts, or only business ones?
A: This change is specific to Microsoft Entra ID, which is the identity system behind Microsoft 365 business and enterprise accounts. Personal Outlook and Hotmail accounts run on a separate consumer system and are not part of this retirement timeline. Microsoft has been pushing consumer accounts toward passkeys as well, but that is a different track with different dates.
Q: What happens to an employee who loses the phone holding their passkey?
A: With a synced passkey, nothing much. The credential lives in their iCloud Keychain or Google Password Manager and reappears when they sign in to a replacement device. With a device-bound passkey, the credential is gone with the hardware, and an administrator has to reset the method and re-enroll them. This is the main reason to plan a recovery process before you deploy device-bound passkeys rather than after.
Q: Can we just switch everyone to the Microsoft Authenticator app instead?
A: Yes. Authenticator push notifications with number matching remain supported and are a large improvement over text messages. Note that Microsoft Authenticator can also hold a passkey, so moving staff to the app and then enabling a passkey inside it is one path rather than two. Windows Hello for Business is another supported option for teams already standardized on Windows.
Further Reading
Related Articles
- The Microsoft 365 Phishing Scam That Skips the Fake Page. The attack that defeats a text-message code, and a large part of why Microsoft is retiring them.
- Why I Ditched My DIY Password System for NordPass. Where synced passkeys will live once your staff stop typing codes from a phone.
- Deepfake Voice Scams Are a Wire Transfer Risk in Springfield. Why a phone call proves very little about identity, the same weakness driving this retirement.
- Windows 10 Security Updates Extended Again Through 2027. The other Microsoft deadline landing in the same planning window as this one.
Browse by Topic
Justin White is the founder of TechGents, an owner-operated IT consulting firm in Springfield, Illinois, serving small businesses and professional practices across Sangamon County and Central Illinois. He has spent nearly two decades working across Apple, Windows, and mixed-platform environments, and writes Digital Decorum to give business owners the version of a technology story they can act on.
The change itself is defensible. Text-message codes have been the weakest link in business authentication for years, and the industry has known it for most of that time. What makes this one demand attention is the calendar: it lands automatically, it lands on a date somebody else picked, and the consequence shows up at the login screen on a Monday morning rather than in an email you can file for later.
Eleven days is enough time to find out who is affected. Five months is enough time to migrate a small team without drama. Doing neither is also a choice, and it gets made by default.
If you would rather have someone map your tenant, brief your staff, and run this migration on a schedule instead of a deadline, get in touch with TechGents. We work with small businesses and professional practices across Central Illinois, and this is the kind of project that goes quietly when it is planned and loudly when it is not.