Microsoft 365 text message codes end on 1 February. Your team will be asked for a passkey.

If your team signs in to Microsoft 365 with a code sent by text message, that is about to stop. Under the Microsoft SMS MFA retirement, Microsoft will no longer send its own sign-in codes by text or voice call from 1 February 2027. People who rely on them will be asked to set up a passkey instead.

It’s a good change. The main thing to get right is that your team knows it’s coming, so a new prompt on their phone doesn’t look like a scam.

What’s changing, and when

Microsoft set this out in a message to Microsoft 365 admins (reference MC1426371):

• Since 1 September 2026: passkeys are switched on by default for anyone who uses text or voice codes, and Microsoft has started nudging people to add one.
• 1 February 2027: Microsoft stops sending text and voice codes for most users.
• 1 July 2027: the same happens for Global Administrators and guest users from outside your organisation.

Passkeys are included in every Microsoft 365 plan, so there’s nothing extra to buy. Businesses that really need text codes can connect their own telecoms provider through Microsoft, but that is a paid add-on charged per message, and few will need it.

What your team will see

Someone whose only sign-in method is a text code will get a prompt asking them to create a passkey. Microsoft lets them confirm who they are by text one last time, then their phone or laptop becomes the key. After that, signing in means a fingerprint, a face scan or the phone’s PIN, with no code to type.

People who already use the Microsoft Authenticator app with number matching won’t notice much. The people to think about are the ones who have only ever had text codes: often senior staff, part-timers, and anyone set up in a hurry.

Why Microsoft is doing it

A text code can be read out to a caller, typed into a fake sign-in page or diverted by a criminal who has talked a phone network into moving a number to a new SIM. Microsoft says text and voice codes no longer hold up against the phishing kits now in use. A passkey only works on the real Microsoft site, so a fake page gets nothing.

The weakest way into your Microsoft 365 is being switched off for you. The only risk is that your team mistakes the new prompt for a scam.

Ashley Adkins, fromIT

A note you can send your team

Copy this, change it to suit, and send it before the prompts start:

Microsoft is retiring text message sign-in codes for our work accounts. At some point soon, when you sign in, Microsoft will ask you to set up a passkey. This is genuine. It only ever happens on the Microsoft sign-in page or in the Authenticator app. Follow the steps and your phone or laptop will unlock your account with your fingerprint, face or PIN. We will never ask you to read out a code or approve a sign-in over the phone. If anyone does, hang up and tell us.

If you look after the Microsoft 365 account

Find out who still relies on text or voice codes. The authentication methods activity report in the Microsoft Entra admin centre shows how each person signs in. Help those people move before February rather than on the morning they’re locked out, and start with admin accounts even though they have until July. If anyone can’t use a phone for work, a hardware security key is the simplest answer. Our MFA guide covers the options.

For Cyber Essentials, text codes still count as multi-factor authentication. Moving to passkeys simply puts you on a stronger footing, and assessors will be glad to see it.

Sources

• Microsoft 365 Message Center MC1426371: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
• BleepingComputer: Microsoft urges Entra ID admins to migrate users to passkeys
• Windows Latest: Microsoft mandates passkeys in Entra by February 2027 (22 July 2026)