SMS codes are disappearing from Microsoft 365: why passkeys are becoming the new standard

Do your staff sign in to Microsoft 365 today with a password and a code by text message? Then something fundamental changes over the coming year. In mid-July Microsoft announced that passkeys will become the default sign-in method from 1 September 2026, and that SMS and voice codes are being phased out. That is more than a detail for the IT department, because it affects everyone in your organisation who signs in. The good news is that signing in becomes safer and easier at the same time.

What is a passkey, in plain language?

A passkey replaces the combination of password and code. You sign in the way you unlock your phone: with your fingerprint, your face or a PIN on your own device. There is no longer a password to forget, reuse or have stolen. And there is no longer a code you might hand over to a scammer by mistake.

Technically it works with cryptographic keys, following the FIDO2 and WebAuthn standards. Your device proves mathematically that it is you, without any secret travelling over the line that someone could intercept. That is the essential difference from an SMS code, which can be intercepted, forwarded or coaxed out of you. A passkey cannot.

Why is Microsoft moving away from SMS codes?

Attackers are hunting for credentials on a massive scale, and SMS codes offer too little protection against that. In early July another campaign came to light in which attackers made more than 81 million sign-in attempts on Microsoft 365 environments in two weeks, using passwords from old data breaches. On top of that, AI makes phishing so convincing that far more people fall for it than before. A code a person can pass on is a code a scammer can coax out of them. That is why the whole industry is moving to phishing-resistant methods, and now Microsoft is taking that step for everyone.

The timeline

• 1 September 2026: passkeys become the default. Users who currently use SMS or voice codes are automatically enabled for passkeys and asked to register one at their next sign-in.
• From late October 2026: organisations that want to keep SMS for a specific reason can set up a third-party telecom provider. That costs extra money and effort.
• 1 February 2027: Microsoft stops sending SMS and voice codes itself. Anyone who has not registered an alternative by then can no longer sign in with SMS.

Do you already use the Microsoft Authenticator app, Windows Hello or a security key? Then there is nothing to worry about, because those methods keep working.

What should you do now?

The transition is largely automatic. Even so, it pays to take charge of it yourself. That way you avoid confusion and helpdesk tickets, and above all staff who suddenly can't get in come February 2027. In practice:

• Map who still relies on SMS. In Entra ID you can see exactly which users have SMS or voice codes as a method today. That overview is your action list.
• Start the switch yourself, before Microsoft does it. With a registration campaign in Entra ID you invite users in phases to set up a passkey or the Authenticator app, at your pace and with your own communication.
• Inform your people. One short explanation ("soon you'll sign in with your fingerprint, just like on your phone") prevents nine out of ten questions.
• Think about exceptions. There are solutions for shared devices, production environments and people without a smartphone, such as physical security keys. You want those arranged in advance, not in January 2027.

Conclusion

The end of the SMS code is an improvement. Signing in gets faster and fundamentally safer. Automatic does not mean everything sorts itself out, though, certainly not in organisations with dozens or hundreds of users. Do you want to know who in your organisation still relies on SMS codes today, and how to organise the switch smoothly? A focused security review shows you straight away.