The days of logging in to your Microsoft account and getting a text to verify your login are coming to an end.
On February 1, 2027, Microsoft is making the switch to exclusively using passkeys for 2-factor authentication.
Any business using Microsoft 365 where staff login with a texted or called-in code will be affected.
The Change
Starting September 1, 2026 passkeys will become the default sign-in method, Microsoft users will be prompted to register a passkey.
On February 1, 2027, Microsoft-provided SMS and voice authentication will be fully retired.
Anyone who hasn't registered a passkey by then can't sign in with SMS/voice anymore.
This applies to every user, with no way to opt out permanently.
What is a passkey?
A passkey is basically your face, your fingerprint, or your device standing in for a password.
Instead of typing in a code Microsoft texts or calls you, you unlock your account the same way you already unlock your phone — Face ID, a fingerprint, a PIN, or a physical security key.
It’s also a real security upgrade, not just a convenience one.
A passkey is tied to your specific device, so there’s no code floating around that a scammer can intercept, forward, or trick you into reading back to them over the phone, which is exactly how a lot of SMS-based scams work today.
For most people, this shows up as a simple prompt from Microsoft Authenticator, Windows Hello, or their browser asking them to “sign in with a passkey” instead of “enter your code.”
In practice, it’s often a smaller change to their daily routine than it sounds — one tap instead of typing six digits.
Why This Switch Matters
This isn’t a change you can quietly opt out of.
Microsoft is enforcing it across every user, so if your business hasn’t moved off SMS and voice codes by February 1, 2027, staff will simply be locked out until they register a passkey.
For a lot of small and mid-sized businesses without a dedicated IT team watching Microsoft’s roadmap, that’s exactly how this will show up, not as a planned upgrade, but as a Monday morning where half the office can’t log in.
There’s also a real security reason behind the switch, not just a Microsoft product decision.
Text and voice codes can be intercepted through SIM-swapping or call-forwarding scams, and they’ve become a common target for attackers specifically because they’re easy to trick people into handing over.
Passkeys close that gap since there’s no code to steal in the first place
What To Do
Find out who’s still using SMS or voice codes. Check with the NTS Team at support@networkthinking.com, and we will show you exactly which team members are affected.
Start migrating now, not in January 2027. Get staff registered for a passkey through Microsoft Authenticator or another option while there’s no deadline pressure and no rush.
Give staff a heads-up before you flip the switch. A passkey registration prompt showing up out of nowhere can look a lot like a phishing attempt if nobody’s expecting it.
Have any further questions? Reach out to us!