Microsoft is getting rid of text message sign-in codes for Microsoft 365. What is actually happening and when?

If your team signs into Microsoft 365 by typing a code from a text message or phone call, Microsoft has put an expiration date on that routine. The company is retiring its own SMS and voice authentication across Microsoft 365 and Entra ID and moving everyone toward passkeys, which use your device's fingerprint, face, or PIN instead of a typed code.

Two dates matter. On September 1, 2026, anyone still set up for texted or voice codes will automatically have passkeys enabled, and Microsoft will start prompting them to register one at sign-in. The prompt can be snoozed, so nothing breaks that day. On February 1, 2027, Microsoft-provided text and voice codes stop working entirely. From that point, a user whose only verification method is a texted code will hit a blocking prompt and must register a passkey before they can finish signing in. Microsoft states plainly that there is no opt-out from the February enforcement for any organization.

Why the change? Texted codes are among the weakest forms of MFA: they can be phished by fake login pages, stolen through SIM-swap attacks on your phone number, or read to a scammer over the phone. Passkeys are resistant to all three, and Microsoft is making the stronger option the default rather than the exception.

There is an escape hatch for organizations that genuinely need SMS, like certain regulated industries: third-party telecom providers offered through Microsoft's Security Store, at per-message cost. For a typical small business, that is the wrong tool. Moving to passkeys is free, faster for users, and meaningfully more secure.

The practical move is to get ahead of it: find out who in your organization still signs in with texted codes, register passkeys on your own schedule between now and early 2027, and sort out the odd corners (shared computers, staff without smartphones, password reset flows) before the deadline sorts them out for you. If an IT provider manages your Microsoft 365, they should be bringing this to you, not the other way around.