Microsoft Is Ending Text-Message Sign-In Codes. Here's What Your Staff Will See.
Updated: Nov 4
If your team signs in to Microsoft 365 and gets a code by text message or a phone call, that is about to change. Microsoft has announced it will retire its own text and voice sign-in codes on February 1, 2027. After that, anyone who only uses those codes will have to set up a passkey before they can sign in.
What exactly is changing?
According to Microsoft's announcement:
Passkeys are now the default sign-in method. Staff who use text or voice codes are already being prompted to register a passkey.
On February 1, 2027, Microsoft stops sending text and voice sign-in codes for most users.
Global Administrators and external users have until July 1, 2027.
After the cut-off, a user whose only method is a text or voice code is stopped at sign-in and must register a passkey to continue. There's no opt-out.
Who in my business is affected?
Anyone whose only second step at sign-in is a texted code or a phone call. That often includes long-time staff, part-timers, front-desk accounts, and owners who set up their account years ago. Staff who already use the Microsoft Authenticator app, Windows Hello or a security key aren't blocked, though they may still see prompts to add a passkey.
What will my staff actually see?
A screen at sign-in asking them to create a passkey, and they won't be able to skip it. If that happens on a busy Monday, with no warning, expect calls, confusion and a few people locked out of email. Scammers know this too, so warn staff that a real prompt appears on Microsoft's own sign-in page, never in a call or text from "IT." Here's how fake help-desk calls use passkey changes as cover.
What is a passkey, in plain terms?
A passkey lets you sign in with your phone's or computer's face scan, fingerprint or PIN instead of a password plus a code. It's tied to the real Microsoft website, so it can't be typed into a fake login page. That's why it stops the kind of phishing that gets around text-message codes. Our guide to phishing-resistant sign-in covers the move in more detail.
Fake sign-in pages also arrive through printed codes. See our guide to QR code phishing.
Can we keep using text codes?
Microsoft says organizations that still need text or voice codes can bring their own telephone provider through the Microsoft Security Store, at their own cost. For most small offices, moving staff to passkeys is the simpler and safer path.
What should we do before February 1?
Find out who still relies on text or voice codes. Your IT provider can pull this list from Microsoft 365.
Tell staff the change is coming and what the real prompt looks like.
Help each person register a passkey on a device they always have.
Make sure every account has a backup method, so a lost phone isn't a lockout.
Remove sign-in methods and accounts that belong to people who've left. Our offboarding checklist walks through it.
How 24uNet helps
We plan and roll out passkeys for Microsoft 365 businesses, so staff switch on our schedule, not at a forced prompt. Strong sign-in is a core part of our Security Baseline, and our identity threat protection watches for stolen sign-ins after that. To plan your switch, contact us.
Frequently asked questions
When does Microsoft stop sending text sign-in codes?
February 1, 2027 for most users, and July 1, 2027 for Global Administrators and external users.
What happens if someone only has text codes after that date?
They must register a passkey at sign-in before they can get into their account.
Is the Microsoft Authenticator app affected?
No. The retirement covers Microsoft-sent text and voice codes.
Do we have to buy anything for passkeys?
Passkeys work with phones and computers most staff already use.
Comments