As of November 2, 2026, Microsoft plans to stop sending text message and phone call sign-in codes for most Microsoft 365 users on February 1, 2027. If your team relies on Microsoft 365 SMS authentication, a code texted to a phone, anyone whose only second step is that code will have to set up a passkey at their next sign-in after that date. You have about three months to get ahead of it, and the first check takes one script.
What is Microsoft changing about text message sign-in codes?
Microsoft is ending its own text and voice delivery of sign-in codes in Microsoft Entra ID, the sign-in system behind every Microsoft 365 account. Microsoft's retirement page says SMS and voice "are no longer positioned as secure authentication methods and will no longer be provided natively in Entra ID" (Microsoft Learn). The same page says passkeys became the default sign-in experience on September 1, 2026. BleepingComputer reported Microsoft's latest reminder to admins on October 28, 2026.
When does it happen, and who is affected?
February 1, 2027 is the date for most people. Microsoft's retirement page says Microsoft-provided SMS and voice authentication is retired on that date for all users except Global Administrators and external users, who get until July 1, 2027. Internal guest users follow the February 1 date. Microsoft's retirement FAQ says this timeline covers public cloud environments, which is where a normal small business Microsoft 365 account lives.
What happens to an employee who only uses text codes?
They hit a prompt they can't skip. Per Microsoft's retirement page, after February 1, 2027, users whose only sign-in method is SMS or voice "are required to register a passkey during sign-in to continue accessing their account," and "There is no opt out from this February 1 behavior." The FAQ says people won't be locked out for good. They just have to finish the passkey setup before they can sign in.
For a crew lead who signs in from a truck at 7 a.m., that's a bad morning to find out. Do the setup while someone is standing next to them.
How do I find out who on my team still uses text codes?
Ask whoever manages your Microsoft 365 account to run Microsoft's usage script. Microsoft's retirement page links a PowerShell script for this and says the admin needs the Global Reader, Authentication Policy Administrator or Security Reader role. The FAQ says any non-zero result means your tenant is in scope. Here's what I'd send them:
"Please run Microsoft's SMS and voice usage script for our Microsoft 365 tenant. Send me the list of people who sign in with text or phone codes, and tell me whether any of them is a Global Administrator."
If you don't have an IT provider, you're probably the admin, and the script is yours to run.
What should I move my team to?
Passkeys are the path Microsoft recommends, and the FAQ says moving SMS and voice users to passkeys comes at "no additional cost." The retirement page lists where a passkey can live: Microsoft Authenticator, an Entra passkey on Windows, a synced credential manager like iCloud Keychain or Google Password Manager, or a hardware security key.
Here's a simple order of work:
- Admins first. Global Administrators have until July 1, 2027, but they're your most valuable accounts. Move them now.
- Everyone who only has a text code. Have them register a passkey before February 1. The FAQ says people who use Authenticator verification codes won't get the blocking prompt either, but Microsoft treats passkeys as the stronger choice.
- Tell your team. Send one short message with the date and the steps. Microsoft's retirement page links ready-made templates for email and Teams.
- Remove the old method afterward. The FAQ says to take people off the SMS and voice policy once their replacement works, so they stop getting nudges.
Can I keep text codes if my team really needs them?
Yes, but it costs money and takes setup. Microsoft's retirement page says businesses with a real regulatory or operational need can configure a telephony provider through the Microsoft Security Store beginning October 30, 2026, and the FAQ says pricing varies by provider and region. Soprano and Telesign are the first providers, in private preview. For most small offices in Battle Creek, Kalamazoo or Portage, passkeys are the cheaper and simpler move.
Is there a quick way to delay the passkey prompts?
A temporary opt-out exists, but it only delays the automatic passkey prompts. It doesn't move the February 1 date. Microsoft's retirement page says "There is no opt out for enforcement." The opt-out is set through Microsoft Graph, so it's an admin job. I'd skip it unless you're setting up a telephony provider.
Why does Microsoft want people off text codes?
Phishing and SIM swapping. Microsoft's FAQ calls SMS and voice "among the most vulnerable authentication methods available today." A passkey uses cryptographic keys instead of a shared code, so a fake login page has nothing to capture. Stolen sign-in sessions are a related problem, and I wrote about what token theft means for your Microsoft 365 account last week.
Who can help me check?
Start with whoever manages your Microsoft 365 account, and send them the request above. If nobody owns that for your business, that's the real gap. While someone is in the admin center, my guide to setting up DMARC on Microsoft 365 covers the email side of the same account. You can also run the free email security check on your domain, or ask for an email security audit if you want a full read.