Time to Move Away from SMS Codes: Microsoft’s Passkey Changes Explained

If your business still relies on text messages or phone calls to verify Microsoft 365 sign-ins, change is coming and it is worth planning for it now. 

Microsoft is retiring its built-in SMS and voice authentication for Microsoft Entra ID (the system behind sign-ins for Microsoft 365, Teams, SharePoint and more), in favour of passkeys.

What’s changing, and when 

• From 1 September 2026: Passkeys become the default. Anyone using SMS or voice codes is automatically enabled for passkeys too, and prompted to register one at their next MFA sign-in. Microsoft has confirmed people can skip the prompt as many times as they like unless an admin turns that option off, so this alone won’t force anyone’s hand overnight. 

• From 30 October 2026: Businesses with a genuine need to keep SMS or voice can set up a paid third-party provider via the Microsoft Security Store. 

• From 1 February 2027: Microsoft switches off its own SMS and voice delivery entirely, across every tenant, with no opt-out for continued use of Microsoft-hosted delivery. Microsoft is building in a temporary opt-out to give businesses breathing room to finish their transition, with the technical detail expected from 1 August 2026. Worth noting too this retirement also affects self-service password reset (SSPR); if you want to keep using a phone number for that, you’ll need a subscription with one of the approved telecom providers. 

Why it matters 

Microsoft’s direction is clear: as businesses make greater use of AI and cloud services, sign-in methods need to be harder to phish and easier to manage securely. SMS and voice codes were a useful step up from passwords alone, but attackers have found ways around them from fake sign-in pages that capture both passwords and codes, to SIM-swapping and scam calls that persuade people to share one-time codes. Passkeys reduce that risk because there is no code to intercept, type in, or read aloud; the passkey only works with the genuine service it was created for. 

The good news is that moving from SMS or voice codes to passkeys does not add extra Microsoft licensing cost. For most businesses, the main investment will be in planning the rollout properly, communicating the change clearly, and making sure staff have the right support as they register their new sign-in method. 

The options 

• Synced passkeys: usable across a person’s approved devices; convenient for general staff. 

• Device-bound passkeys: tied to one device (e.g. Microsoft Authenticator or a Windows PC); good for admins and finance staff. 

• Physical security keys: hardware keys for your highest-risk accounts. 

What to do now 

1. Identify who’s affected: check who’s set up for SMS or voice in Entra ID, including as a backup, and don’t overlook admin, finance and shared accounts. 

1. Match the method to the person: device ownership, sensitivity of access, and recovery needs all vary by role. 

1. Pilot before rolling out: test with a small group first to catch device or process issues. 

1. Sort out account recovery: plan for lost phones, forgotten PINs and leavers, with proper identity checks. 

1. Protect admin accounts first: these are the accounts attackers want most. 

1. Communicate clearly: let staff know what to expect, and warn them that scammers may exploit this change with fake “authentication upgrade” emails. 

Waiting until the February 2027 deadline could leave staff locked out and create avoidable pressure on your support team. Starting early gives you time to test the right approach, support staff through the change, and strengthen protection before the old methods are switched off. 

How Kriston Technology can help 

If you are not sure how this change affects your Microsoft 365 setup, we can help you get a clear picture before the deadline. Our team can review your current authentication methods, identify who still relies on SMS or voice codes, recommend the right passkey options for different teams, and manage the rollout in a way that keeps staff informed, supported and secure. We can also prioritise admin accounts, run a small pilot, prepare staff guidance, and put recovery processes in place so the change feels controlled rather than rushed.