If your staff sign in to Microsoft 365 with a code sent by text message, that stops working early next year. The good news: the replacement is more secure, costs nothing, and most teams can switch in a couple of weeks.
Microsoft has decided that text-message and phone-call codes are no longer good enough as the default second factor for Microsoft 365. Its official FAQ calls SMS and voice "among the most vulnerable authentication methods available today", and is making passkeys the default instead.
| Date | What happens |
|---|---|
| 1 September 2026 | Passkeys automatically enabled for users set up for SMS or voice. They start seeing prompts to register one (which they can snooze). |
| 30 October 2026 | Configuration for third-party telephony providers through Microsoft Security Store begins to become available. |
| 1 February 2027 | Microsoft-provided SMS and voice retired for all users except Global Administrators and external users. Users with no other method must register a passkey to continue. |
| 1 July 2027 | Retirement extends to Global Administrators and external users. |
Dates as published by Microsoft for public cloud tenants at time of writing. Azure AD B2C is out of scope.
If you've noticed staff asking "what's this passkey pop-up?" since September, this is why.
An SMS code is better than a password alone, but it has well-known weaknesses:
Passkeys are phishing-resistant. The passkey is cryptographically tied to the genuine Microsoft sign-in site, so a lookalike page simply can't use it. Nothing is typed, so there's nothing for an attacker to capture. For a deeper look at MFA methods, see our MFA guide.
| Method | Phishing-resistant? | Cost | Best for |
|---|---|---|---|
| Passkey in Microsoft Authenticator | Yes | Free | Most staff with a smartphone |
| Windows Hello for Business | Yes | Included with Windows | Staff on company-managed Windows laptops |
| FIDO2 security key (e.g. USB/NFC key) | Yes | Hardware cost per key | Admins, shared devices, staff without smartphones |
| Authenticator push notification | Partly (with number matching) | Free | A stepping stone, not the destination |
| SMS / voice via third-party telephony provider | No | Per-message charges | Specific regulatory or operational needs only |
Microsoft offers a temporary opt-out from the automatic passkey prompts between 1 September 2026 and 1 February 2027, set through Microsoft Graph. It only delays the nudges while you finish your own migration. There is no opt-out from the 1 February enforcement itself: on that date, users without another method will have to register a passkey to sign in.
If your organisation genuinely needs SMS or voice, perhaps for a regulatory reason or a workforce without smartphones, you can contract a telephony provider through Microsoft Security Store. Expect per-message charges, and expect to justify the weaker method to your auditors.
Many Singapore SMEs set up Microsoft 365 MFA years ago using SMS because it was the easiest option. If you hold or are working towards CSA Cyber Essentials, or follow MAS TRM guidance on strong authentication, moving to phishing-resistant MFA strengthens your position. It's also a meaningful control under the PDPA's Protection Obligation, covered in our PDPA IT checklist.
Treat the deadline as a free security upgrade with a fixed date, not a chore. A planned rollout over the next few weeks takes far less effort than fielding fifty "I can't log in" calls on the first working day of February.
According to Microsoft, Microsoft-provided SMS and voice authentication is retired on 1 February 2027 for most users in public cloud tenants. Global Administrators and external users follow a later date of 1 July 2027. Internal guest users stay on the 1 February 2027 date.
Microsoft says no. Users whose only MFA method is SMS or voice will instead get a blocking prompt to register a passkey before they can continue signing in. That is still disruptive on a Monday morning, so it's far better to migrate users before the deadline.
No. Microsoft states that migrating users from Microsoft-provided SMS and voice to passkeys carries no additional cost. Passkeys can be stored in the Microsoft Authenticator app on a phone or on hardware security keys, which you buy separately if you choose that option.
Only if you contract a telephony provider through Microsoft Security Store, which carries per-message costs that vary by provider and region. Microsoft positions this for organisations with a genuine business, regulatory or technical need for SMS or voice. For most SMEs, passkeys are the better and cheaper choice.
Yes. The retirement of Microsoft-provided SMS and voice applies across Microsoft Entra, including self-service password reset. Review which methods your users rely on for password reset as well as for sign-in.
Book a free consultation. We'll check which of your users still rely on SMS or voice, and plan a passkey rollout that doesn't lock anyone out.
