Microsoft passkeys: Why SMS sign-in codes end in 2027

Microsoft passkeys are now the default way to sign in to Microsoft 365, and the text message codes many offices rely on have a hard end date. Microsoft says it will retire its own SMS and voice sign-in codes for most users on February 1, 2027, according to its official retirement notice and Message Center post MC1426371. After that date, any employee whose only second step is a text or a phone call will be stopped at sign-in until they set up a passkey. On October 28, BleepingComputer reported that Microsoft is once again urging admins to move users before the cutoff.

Our stance is clear. Business owners should treat this as a planned upgrade and finish it by mid-January, well ahead of the deadline. Paying to keep text codes alive should be the exception for a few documented cases. Here is what is changing, what it means for your staff, and how to get through it without a Monday morning of locked-out employees.

What Microsoft announced and when

Microsoft first laid out the plan in a July 13, 2026 security blog post. Microsoft Entra ID is the sign-in system behind Microsoft 365, Outlook, Teams and SharePoint, so this change reaches nearly every business that uses those tools. The timeline, confirmed in both the blog post and Microsoft’s documentation, looks like this:

• September 1, 2026. Passkeys became the default sign-in experience. Users who were set up for SMS or voice codes were automatically enabled for passkeys and began seeing prompts to register one.
• October 30, 2026. Organizations that still need SMS or voice can now pick and set up an outside telephony provider through the Microsoft Security Store.
• February 1, 2027. Microsoft-provided SMS and voice codes are retired for all users except Global Administrators and external users.
• July 1, 2027. The same retirement reaches Global Administrators and external users.

The October reminder covered by BleepingComputer also notes that Microsoft wants organizations using SMS as a first sign-in factor to move users to supported alternatives. In Microsoft’s words, quoted in coverage of the notice: “If your organization currently uses SMS sign-in for first-factor authentication, migrate users to supported alternatives based on their scenarios.”

What happens to employees who still use text codes

This is the part that will reach your front desk. Microsoft’s retirement notice says that after February 1, 2027, a user whose only multifactor method is SMS or voice must register a passkey during sign-in. The prompt is blocking, so the employee cannot get into email or files until they finish it. Microsoft says there is no opt-out from this enforcement. The July blog post says the same thing: passkey prompts will be enforced in all tenants with no opt-out.

Microsoft offers a temporary opt-out, but it only delays the early nudges between September 2026 and February 2027. It does not move the deadline.

A few groups are in better shape than others:

• Users who already sign in with a passkey, Windows Hello for Business or another phishing-resistant method are not affected, according to the retirement notice.
• Users with a second method already registered, such as the Microsoft Authenticator app, keep using it. Microsoft’s FAQ says people who use authenticator app codes will not get the blocking prompt, though it also notes those codes are not phishing-resistant.
• Password resets are included. The FAQ says the retirement applies across Microsoft Entra, including self-service password reset. If your staff reset forgotten passwords with a texted code, that path changes too.

The real risk for a small office is simple. Nobody checks who still depends on text codes, February arrives, and several people hit a wall at the same moment.

Why Microsoft is dropping SMS codes

Text message codes were a big step up from passwords alone, and for years they were the easiest way to add a second step. The problem is that attackers have learned to get around them. Microsoft’s blog post says SMS and voice rely on shared secrets or channels that attackers increasingly intercept, phish or manipulate. A fake login page can ask for the code and pass it along in real time. A SIM swap, where a criminal talks a phone carrier into moving your number to their phone, sends the code straight to them.

AI has made the fake page problem worse. Microsoft’s blog cites its Digital Defense Report 2025, which found AI-enabled phishing campaigns reaching click-through rates of up to 54 percent, compared with about 12 percent for traditional campaigns. We covered how these emails have changed in Phishing attacks are getting smarter: How AI is changing the threat landscape.

Passkeys work differently. A passkey uses public-key cryptography, so there is no code for an employee to type into the wrong site. The passkey only works with the real service it was created for, which means a look-alike login page gets nothing. The U.S. Cybersecurity and Infrastructure Security Agency has pushed in this direction for years. In its October 2022 guidance, reported at the time by Infosecurity Magazine, CISA said it “strongly urges all organizations to implement phishing-resistant MFA.”

The debate: pay to keep SMS, or move to passkeys?

Microsoft left one door open. Starting October 30, organizations can sign up with a telephony provider in the Microsoft Security Store and keep sending SMS and voice codes after February. Microsoft’s blog says organizations that take this route pay the telecom costs, and the FAQ says pricing varies by provider, region and usage. Passkeys, by contrast, come at no added cost for most organizations, according to Microsoft.

We understand why some owners will be tempted to pay and move on. Text codes are familiar. Nobody has to learn anything new. Some staff do not have company phones and may not want work tools on their personal devices. A few roles, like a shared front desk computer or a warehouse kiosk, do not fit neatly into a one person, one phone model.

We still think paying for SMS is the wrong default for most businesses, for three reasons.

• You would be paying to keep the weaker option. The whole reason for the change is that text codes can be phished and redirected. Keeping them alive keeps that risk alive.
• Regulated clients face rising expectations. Healthcare practices, government contractors and financial firms are being asked to show strong sign-in controls. Phishing-resistant methods are a cleaner answer to those questions than texted codes.
• The hard cases have other answers. Microsoft points to FIDO2 security keys as a phishing-resistant choice for people who cannot use a phone passkey. A small USB or NFC key on a lanyard often solves the shared desk and no-company-phone problems.

There are fair exceptions. If a contract, a regulator or a technical limit truly requires SMS for a specific group, document it, set up a provider and pilot it. Microsoft’s Message Center post recommends finishing that setup at least four weeks before February 1, which puts the practical deadline around January 4, 2027. Keep that group small and review it every year.

How to roll out Microsoft passkeys before February

For most small and mid-size businesses, this is a few weeks of steady work. Microsoft’s own guidance lays out the steps, and here is how we would run it for a typical office in Maryland, Virginia or DC.

1. Find out who still uses text codes

Microsoft’s retirement notice links to a free PowerShell script that lists users who rely on SMS or voice. It needs an admin role such as Global Reader or Security Reader. Pay special attention to anyone with no other method registered, since those are the people who will be blocked.

2. Turn on passkeys and a registration campaign

In the Microsoft Entra admin center, confirm that passkeys (FIDO2) are enabled for the people who need them. Microsoft recommends a registration campaign, which prompts users to set up a passkey the next time they sign in. Microsoft’s blog describes two kinds of passkeys: synced passkeys stored in tools such as iCloud Keychain or Google Password Manager, and device-bound passkeys in Microsoft Authenticator, Windows or a physical security key. Decide which fits your business before you turn the campaign on.

3. Start with admins and the people who move money

Global Administrators get until July 1, 2027, but we would not wait. Admin accounts and the staff who approve payments or handle sensitive records are the accounts attackers want most. Move them first. Our Microsoft 365 security settings checklist covers other admin protections worth checking at the same time.

4. Plan for the hard cases

List shared computers, staff without smartphones and anyone who works where phones are not allowed. Order security keys for them now so supply is not a problem in January.

5. Tell your staff before the prompts appear

Microsoft provides end-user communication templates, linked from the same retirement notice. A short email that explains what the prompt will look like, why it matters and who to call for help prevents a lot of confused tickets. It also helps staff spot a fake. If anyone ever asks an employee to read a sign-in code over the phone, that is a scam. Our guide on how to recognize social engineering attacks is a good companion read for your team.

6. Fix password resets

If self-service password reset uses text codes, move it to another method. Otherwise the first person who forgets a password after February will end up calling your IT provider instead of resetting it themselves.

Frequently asked questions

Will my employees be locked out on February 1, 2027?

Only users whose sole multifactor method is a Microsoft-provided SMS or voice code are affected. They will not lose their account. Microsoft says they will be required to register a passkey during sign-in before they can continue, which can still stall someone at a busy moment.

Do passkeys cost extra?

Microsoft says moving SMS and voice users to passkeys carries no additional cost. Keeping text codes through a telephony provider does cost money, with pricing set by the provider. Physical security keys are a separate hardware purchase.

Can we keep using the Microsoft Authenticator app?

Yes. The retirement covers Microsoft-provided SMS and voice codes. Microsoft’s FAQ says authenticator app codes remain supported after February 1, 2027, though they are not phishing-resistant. Microsoft Authenticator can also hold a passkey, which is the stronger option.

What if an employee does not want work tools on a personal phone?

A FIDO2 security key is the usual answer. Microsoft points to security keys as a phishing-resistant choice when a phone passkey is not an option. They are small, durable and do not require a smartphone.

Get your passkey rollout done before the deadline

SADOS helps businesses across DC, Maryland and Virginia manage Microsoft 365 sign-in security, including healthcare practices, government contractors and financial firms with strict requirements. We can find every user who still depends on text codes, set up passkeys and security keys, and walk your staff through the change on a schedule that keeps work moving. Talk to a SADOS engineer about your passkey plan.