We handle all your technical problems so you can focus on growing your business.
Close-up of a smartphone keyboard below an empty text message field.
Microsoft 365Practical insight for your business.

If Your Team Signs In to Microsoft 365 With a Text Code, You Have Until February 1

Microsoft is retiring its built-in SMS and voice sign-in codes for Entra ID on February 1, 2027. Here is what changes, what it costs to keep text codes, and a four-step plan for a 10 to 50 person business.

Kevin R.

6 min read

Photo by Samuel Angor on Unsplash

The takeaway

Find out who still signs in with a text or call code, and move them to passkeys before February 1, 2027.

If your team still gets a text message or a phone call to sign in to Microsoft 365, that’s about to change.

On February 1, 2027, Microsoft will stop sending SMS and voice sign-in codes for Microsoft Entra ID, the identity system behind Microsoft 365. Microsoft’s reasoning is blunt: “SMS and voice are among the most vulnerable authentication methods available today and provide significantly weaker protection against phishing and account compromise than passkeys” (Microsoft Learn FAQ).

For a 10 to 50 person business, this is a weekend project if you start now. If you wait for the deadline, it becomes a Monday morning of employees stuck at a sign-in screen.

What exactly is changing

The details matter here. Much of the coverage says “SMS is going away,” and that’s not quite right.

  • Passkeys are already the default. Since September 1, 2026, passkeys “become the default authentication experience and will be automatically enabled for users enabled for SMS or voice” (Microsoft Learn). Microsoft is rolling this out gradually, so your users may already be seeing prompts to set one up.
  • February 1, 2027: Microsoft stops delivering the codes. From that date, “Microsoft-provided telephony delivery for SMS and voice will be retired for all users except Global Administrators and external users.” Users can no longer use SMS or voice to complete multifactor authentication (MFA). That applies across Entra, including self-service password reset.
  • July 1, 2027: Global Admins and external users. These two groups get five extra months. Internal guest accounts are still on the February date.
  • From February 1, 2027, the prompt can’t be skipped. Until then, users can snooze it. After that date, users whose only MFA method is SMS or voice will have to register a passkey during sign-in. Microsoft says the prompt is blocking and “there is no opt out.” It isn’t a lockout, but it will stop people in their tracks.
  • SMS as a sign-in method (no password) is also retiring on February 1, 2027 for workforce tenants, and bringing your own telephony provider (below) doesn’t keep it.

Can you keep text codes?

Technically, yes, if you pay for it. Microsoft is letting organizations bring their own telephony provider through the Microsoft Security Store. Soprano and Telesign are the first providers, and setup opens October 30, 2026. Microsoft confirms that “pricing varies by telephony provider and region” (Microsoft Learn), and its Message Center notice recommends finishing setup at least four weeks before the deadline.

For most small businesses, this is the wrong direction. You would pay extra to keep the method Microsoft itself calls one of the weakest available. It’s meant for regulated industries and edge cases.

What to do this quarter

1. Find out who is still on phone codes. Microsoft publishes a free PowerShell tool, the Entra SMS/Voice Policy Scanner (Get-SmsVoicePolicyUsers.ps1). It needs a read-only admin role, such as Global Reader or Security Reader, and exports a CSV. One caveat: it reports which groups and users your authentication policy targets for SMS and voice. It doesn’t list every individual person in those groups, and it doesn’t show who actually used a text code last week. Treat it as your starting list and check sign-in logs for the rest.

2. Move those people to passkeys in Microsoft Authenticator. For most staff, this is a few minutes with their phone. Passkeys are phishing-resistant because they only work on the real Microsoft sign-in page. A fake login page can’t collect anything useful. Microsoft says migrating Microsoft-provided SMS and voice users to passkeys comes at “no additional cost.”

One warning to give your staff before you start: attackers are already exploiting passkey enrollment. In July, Okta reported a voice-phishing campaign in which callers persuaded employees they needed to register a new passkey and sent them to a fake Microsoft enrollment page. While the employee thought they were enrolling, the attacker registered a passkey of its own on the employee’s account (BleepingComputer). Tell your team who will contact them about this change and how. Anyone else who calls about “upgrading your sign-in” gets a hang-up.

3. Buy hardware keys for the exceptions. Shared front-desk computers, staff who won’t use a personal phone for work, and anyone in a secure area without a phone all fit here. FIDO2 security keys work well for these cases. Order them now, not in January. Microsoft also offers QR code sign-in for frontline workers on shared devices. It’s a handy replacement for SMS-based sign-in, but Microsoft describes it as a single-factor method (a QR code plus a PIN), so don’t treat it as your MFA strategy.

4. Check your cyber insurance paperwork. Carriers ask about MFA, and they’re increasingly specific. Corvus by Travelers states: “we require MFA implementation for remote access, email access, and administrative access,” and notes that text-message codes are “less secure than other methods” (Travelers). Travelers’ cyber application forms include a separate Multi-Factor Authentication Supplement. Marsh McLennan’s analysis of its clients’ controls and claims found that phishing-resistant MFA was associated with a 9% lower likelihood of a breach than other forms of MFA (Marsh McLennan). Moving to passkeys now makes your next renewal questionnaire easier to answer honestly.

The bottom line

The deadline is fixed, and enforcement has no opt-out. Nearly four months is still enough time to do this calmly: an afternoon of discovery, a week of short check-ins with staff, and a small hardware order. It’s not enough time if you start in late January.

Have you started moving off SMS codes, or is it still on the list? If you’d like a hand with the scan and rollout, start with a free assessment.

Sources

Editorial note: This article was drafted with AI assistance from Microsoft’s Learn documentation, Message Center notices and scanner documentation, and the other sources linked above. Dates and setting names are as documented by Microsoft on September 23, 2026, and may change. NightSquawk Tech has not independently tested the retirement behavior described here.