Microsoft retires SMS and voice MFA codes on 1 February 2027, and starts prompting your staff to set up passkeys from 1 September 2026. Here are the four dates that matter, why "we all use the Authenticator app" is not a get-out, and what to do before the prompts start.
Microsoft is switching off the text-message security codes your team uses to sign in to Microsoft 365. The final date is 1 February 2027, but the part that will land on your helpdesk arrives on 1 September 2026, when Microsoft starts prompting your staff to set up a passkey instead. If nobody has told your people this is coming, they'll hit an unfamiliar screen on a Monday morning and ring whoever they think is responsible.
This isn't a Microsoft whim. The National Cyber Security Centre now recommends passkeys to businesses as the default way to log in, and the UK government is replacing SMS verification on its own digital services with the same technology, a change expected to save several million pounds a year. Microsoft is moving the same direction on a fixed timetable.
Here's what's actually changing, what your staff will see, and the one question worth asking your IT provider this week.
What is Microsoft changing?
Microsoft is retiring the SMS and voice call codes it delivers itself, and making passkeys the default way to sign in to Microsoft Entra ID, the identity service behind every Microsoft 365 login. From 1 February 2027, Microsoft-provided SMS and voice authentication stops working.
Text codes aren't being banned outright. Microsoft is getting out of the business of sending them. If your organisation genuinely needs a text-message channel, you'll be able to contract a telecoms provider through the Microsoft Security Store instead. Those costs are typically charged per message and vary by provider and region, so a method that has always been free becomes a line item you own. Moving people to passkeys carries no additional cost.
The reason is straightforward. A text code is a shared secret that arrives over the public phone network. Someone can talk your mobile provider into moving your number onto their SIM, and the code lands on their handset. Someone can also phone a member of your staff, walk them onto a convincing fake login page, and have them read the code out. Passkeys use cryptographic keys held on a device rather than a secret you can be talked into repeating, which is why Microsoft describes them as resistant to phishing, SIM-swap and replay attacks.
Worth noting: this reaches self-service password reset as well as sign-in. If your staff currently recover a forgotten password via a text message, that route is closing too.
The four dates that matter
Most coverage of this change focuses on the two headline dates. There are four, and the middle two decide whether keeping a text-message option is even practical for you.
- 1 September 2026. Users enabled for SMS or voice are automatically enabled for passkeys, and start getting prompted to register one when they complete MFA.
- 18 September 2026. Microsoft publishes the telecoms provider options and terms in the Security Store.
- 30 October 2026. The earliest date you can actually select and configure a telecoms provider.
- 1 February 2027. Microsoft-provided SMS and voice are fully retired. The passkey prompt becomes blocking for anyone whose only method is SMS or voice.
That 30 October date is the one to plan around if you're in a regulated sector and think you'll need to keep a text channel. You can't set one up before then, which leaves roughly three months to evaluate a carrier, contract it and pilot it before the deadline. Anyone who waits until January to start looking at telecoms providers will run out of runway.
What will your staff actually see?
From September, a member of staff signs in as usual, approves their normal MFA, and then meets an extra screen before they reach their inbox. It asks them to make their sign-in more secure by setting up a passkey. There's a short walkthrough, and it takes a couple of minutes.
They can also skip it. By default Microsoft allows unlimited snoozes of that prompt, so a member of staff can dismiss it every single time and never register anything.
After 1 February 2027 the same prompt stops being optional. Users whose only available method is SMS or voice have to register a passkey before they can continue signing in. Microsoft is explicit that there's no opt-out from that behaviour and it applies to every tenant.
So the risk isn't that people get locked out permanently. It's that they meet a mandatory security setup screen on a random morning, with nobody having warned them and no easy way to tell whether it's genuine. That's a phishing-awareness problem as much as an IT one, and it's entirely avoidable with a fortnight's notice by email.
"We all use the Authenticator app already"
This is the most common reason businesses conclude the change doesn't affect them, and it's the one that catches people out.
Microsoft isn't looking at which method your staff use. It's looking at who is still enabled for SMS or voice in policy. A member of staff can have Microsoft Authenticator set up and working, and still have an old mobile number sitting in the authentication methods policy as a backup nobody ever removed. That user is in scope.
On a recent tenant review for a professional services client, we found most staff were already on the Authenticator app, and many still had a redundant mobile number in the policy from years earlier. Every one of those accounts would have been swept into the September change.
There's a second trap. Scope reaches beyond the current authentication methods policy to include anyone enabled in the older per-user MFA settings. Plenty of tenants migrated to the newer policy years ago and never went back to clean out the legacy one, where a text-message option can still be switched on without showing up where you'd expect to look. Microsoft publishes a PowerShell script that reports who's affected, and it's a sensible starting point rather than the whole job.
One more gap to know about if you work with contractors or clients in your tenant: passkey registration isn't supported for guest or external collaboration users yet, with support due by the end of 2026.
What is a passkey?
A passkey is a login credential stored on a device, unlocked with a fingerprint, face or PIN, which proves who you are using cryptography rather than a code you type. There's nothing to read out over the phone and nothing to intercept, which is why the NCSC judges FIDO2 credentials including passkeys to be as secure or more secure than every form of traditional MFA at all stages of a credential's life.
There are two kinds, and the difference matters commercially.
Synced passkeys are saved into a platform credential manager like iCloud Keychain or Google Password Manager, and follow the user across their devices. New phone, passkey already there. Low friction, fast adoption.
Device-bound passkeys are created and stay on one device: a hardware security key, or Microsoft Authenticator on a known handset. Higher assurance, more admin effort.
Which passkey type should your business allow?
Here's where Microsoft's default deserves a second look. Users swept up on 1 September are placed in a passkey profile that allows every type, and your registration campaign is set to Microsoft's own managed settings with those unlimited snoozes. The default is looser and slower than most managed environments should accept.
The setting that governs assurance is attestation, which is Entra checking that a passkey genuinely came from the hardware or app it claims to. Synced passkeys don't support attestation, so the two are mutually exclusive: enforce attestation and the synced option disappears. With attestation off, Entra can't guarantee anything about a passkey, including whether it's synced or device-bound. A synced passkey might be sitting in a director's personal Apple account on a home iPad you've never seen.
Our recommendation is to split by risk rather than pick one setting for everyone, which is also the pattern in Microsoft's own documentation:
- Administrators, finance and directors: device-bound passkeys with attestation enforced. These are the accounts that can move money, reset passwords and read everything.
- General staff: allow synced passkeys. The adoption speed is worth more than the assurance difference for an account with ordinary permissions, particularly with a deadline in play.
Two practical warnings before you configure anything. Attestation is only checked at registration, so passkeys registered while it's switched off keep working if you enforce it later. Turning it on in January won't retroactively tidy up what your staff registered in October. And opting in to passkey profiles is irreversible, with a maximum of three profiles per tenant, so plan the split before you click.
Our take on the delay button
Microsoft has provided a temporary opt-out. Whoever administers your tenant can set a property called passkeyDynamicMigration via Microsoft Graph and your tenant is excluded from the September automatic enablement and the registration campaign.
Used well, that's valuable. It hands you back control of the timing so you can brief staff, configure profiles deliberately and run a registration campaign with a sensible snooze limit against a scoped group, rather than having Microsoft nudge everyone at once on a date you didn't choose.
Used badly, it's the most dangerous button in this whole change. The opt-out expires on 1 February 2027 regardless, and there's no opt-out from what happens then. A business that switches it on and files the problem away has removed the only warning its staff were going to get, while keeping every bit of the February deadline. The opt-out buys you control of the schedule, not relief from the work.
What to do before 1 September
There are a few weeks left before the prompts start. A realistic order of work:
- Find out who's in scope. Not who uses text codes, who's still enabled for them, including in the legacy per-user MFA settings. Run Microsoft's script, then check the older portal by hand.
- Clean out the redundant phone numbers. Users who have Authenticator working and a stale mobile number as backup are the easiest wins, and removing the number takes them out of scope.
- Decide your passkey profiles before you enable them, using the split above. The decision is hard to reverse.
- Tell your staff before Microsoft does. A short email explaining what the screen is, why it's appearing and that it's genuine will prevent most of the tickets and all of the "is this a scam?" calls.
- If you think you need a text channel, document why now, and diarise 30 October. Have the regulatory or operational justification written down before you start paying per message for a method Microsoft has just labelled among the weakest available.
If you're a regulated business, this also intersects with your certifications. MFA strength is a mandatory, sample-tested control under Cyber Essentials Plus, so a migration that leaves users on a retired method is a finding waiting to happen. Our Cyber Essentials Plus implementer's guide covers how the authentication controls are assessed in practice.
What this means for you
Stolen credentials are how most attacks on smaller UK businesses begin, and text codes have been the weak link in that chain for years. Microsoft removing them is genuinely good news for your security posture. The commercial risk sits entirely in the transition: unbriefed staff, a blocking prompt at the worst possible moment, and a scramble in January that costs more than a planned migration in September would have.
Ask whoever runs your Microsoft 365 tenant one question this week: how many of our users are still enabled for SMS or voice? If the answer is a number, you have a plan to make. If the answer is "I'd have to check", that's worth knowing now rather than on 1 February 2027.
We handle this kind of change for the businesses we support as part of managed cyber security, and we work alongside in-house IT teams on a co-managed basis where the tenant admin is internal. If credential security is on your list this quarter, our UK SME ransomware playbook is a useful companion to this piece.
Want a second pair of eyes on your tenant before the September prompts start? Book a Discovery Call and we'll tell you where you stand.
