If your team signs in to Microsoft 365 with a code texted to their phone, that's about to change.
On September 1, 2026, Microsoft started making passkeys the default sign-in method in Entra ID. Users who rely on SMS or voice codes are being prompted to register a passkey at their next MFA sign-in. And on February 1, 2027, Microsoft's built-in SMS and voice authentication is retired for most users.
The Dates That Matter
| Date | What happens |
|---|---|
| September 1, 2026 | Passkeys begin rolling out as the default; users with SMS or voice MFA are prompted to register one |
| Now through February 1, 2027 | A temporary opt-out lets admins delay the passkey push |
| February 1, 2027 | Microsoft-provided SMS and voice MFA retired for most users. Keeping them means paying a third-party telecom provider |
| July 1, 2027 | The same retirement applies to Global Administrators and external users |
Tenants that rely only on Microsoft-provided text or voice codes may see sign-in problems after February 1. Microsoft recommends having your plan in place at least four weeks before.
What a Passkey Actually Is
A passkey replaces the password and the code with something on your device — your phone, your laptop, or a hardware key — unlocked with your face, fingerprint or PIN.
Synced passkeys
Stored in iCloud Keychain or Google Password Manager and available across a user's devices. Easiest for most people.
Device-bound passkeys
Kept in Microsoft Authenticator, Windows, or a FIDO2 security key. Stronger, and the right choice for admins and finance.
Why This Is Good News
Text-message codes can be phished. A fake sign-in page asks for the code, the user types it in, and the attacker uses it. That's exactly how the token-replay campaign we covered earlier this month got past MFA.
A passkey only works on the real Microsoft sign-in page. If someone lands on a fake one, there's nothing to hand over. Microsoft says AI-written phishing campaigns now get click rates up to 54%, compared with about 12% for traditional ones — which is why it's pushing this change.
How to Roll It Out Without a Help Desk Meltdown
Find out who still uses SMS or voice
The Entra authentication methods report shows you. Most offices have more than they think.
Pick the passkey types you'll allow
Synced passkeys for most staff; device-bound passkeys or security keys for admins, owners and anyone who approves payments.
Tell people before the prompt shows up
A short email explaining what they'll see and why stops the "is this a scam?" calls.
Run the registration in waves
Start with leadership and IT, then the rest of the office. Have someone available to help the first day.
Plan for the edge cases
Shared devices, people without smartphones, and accounts used by more than one person all need a decision before February.
Passkeys are included in every Entra plan at no extra cost. The work is in the rollout, not the license.
Free Passkey Readiness Check
We'll find every account still relying on text or voice codes, recommend the right passkey type for each group, and plan a rollout that's done well before February 1.
DM us "CREDS" on LinkedIn or schedule a free consultation · (646) 791-2137