Microsoft is retiring SMS sign-in codes. Here's what changes.

Starting September 1, 2026, some Microsoft 365 users who sign in with SMS or voice codes will be prompted to register a passkey. Microsoft plans to stop providing those codes on February 1, 2027. If your business still relies on them, this is the window to move.

What is changing

If your business uses Microsoft 365, your employees use Microsoft Entra ID whenever they sign in to Outlook, Teams, or SharePoint. Entra ID handles authentication for those services.

Many businesses require a second sign-in step on top of the password. Common methods include an SMS code, an automated phone call, or approval in an authenticator app. That second step is multifactor authentication, or MFA. It means a stolen password is not enough by itself.

Microsoft is moving users toward passkeys as the default second sign-in method in Entra ID. Starting September 1, 2026, employees who currently use SMS or voice codes will be prompted to register a passkey when they sign in. On February 1, 2027, Microsoft stops providing those SMS and voice codes. After that date, users who relied on those methods will need to register a passkey before they can sign in. Microsoft does not provide an opt-out from that change.

Two dates matter: September 1, 2026 for the prompts, and February 1, 2027 for the cutoff. The operational work is identifying affected users, choosing a passkey method, and preparing staff.

Why Microsoft is retiring SMS and voice codes

SMS codes were a major improvement over password-only sign-ins, but they have a basic weakness: users can copy and share them. A phishing site can ask an employee to enter the code, and a SIM-swap attack can redirect text messages to an attacker's device. Automated voice codes have the same underlying problem because the user still receives a reusable code.

Most SMS phishing attacks do not break the code. They trick the user into handing it over. A convincing email sends the employee to a fake Microsoft sign-in page. The employee enters a password, then enters the SMS code the page asks for. The attacker can use both to sign in as that employee.

Microsoft's Digital Defense Report 2025 reported AI-enabled phishing campaigns with click-through rates as high as 54%, compared with roughly 12% for traditional campaigns. Better-written phishing messages make old warning signs such as spelling mistakes less useful. SIM swapping is another failure mode because an attacker can redirect text messages without needing to trick the employee into sharing the code. SMS itself did not change. Attackers have better ways to collect or redirect it.

What a passkey actually does

A passkey uses a cryptographic key pair. Microsoft stores the public key. The private key stays protected on the user's phone, computer, or security key and is unlocked with a face scan, fingerprint, or device PIN. During sign-in, the device proves it holds the private key without transmitting that key.

That removes the shared-code problem. There is no SMS code for an employee to type into a fake page and no code travelling through the phone network. Passkeys are also bound to the legitimate service they were created for, so a fake Microsoft sign-in page cannot use the passkey for the real Microsoft service.

In practice, signing in with a passkey often looks similar to unlocking a phone. Passkeys can live on phones, Windows PCs, or physical security keys. Physical keys are useful for shared computers, front-desk stations, and other cases where a personal phone is not the right place to store the credential.

The dates to plan around

Microsoft has laid out the transition in stages. These are the dates that affect planning.

1. September 1, 2026. Passkey prompts begin. Employees who use SMS or voice codes start getting prompted to register a passkey at sign-in. The prompt can be postponed at first. If staff know it is legitimate and which device to use, enrollment is straightforward. If they do not, expect support tickets.
2. October 30, 2026. The exception path opens. Businesses with a regulatory or technical reason to keep SMS or voice codes can contract a third-party telecom provider through the Microsoft Security Store at their own cost. Microsoft says provider information and pricing will be published earlier, on September 18.
3. February 1, 2027. Microsoft-provided SMS and voice codes end. From this date, SMS and voice codes only work for businesses that configured a third-party provider in advance. Everyone else must use another supported authentication method.
4. After February 1, 2027. Passkey registration becomes required for affected users. Users whose only sign-in confirmation was an SMS or voice code will have to register a passkey before they can access their account. The option to postpone registration ends.

These dates apply to the standard Microsoft cloud used by most Quebec SMBs. Specialized government cloud environments follow a different schedule.

What to do before the prompts arrive

For most SMBs, moving users from Microsoft-provided SMS or voice codes to passkeys does not add a Microsoft licensing cost. The main work is identifying affected users, choosing where passkeys will live, and communicating the change.

1. Find out who still uses SMS or voice codes. Your IT provider can pull this from the Microsoft 365 admin environment. Check owners and long-tenured employees in particular, since older accounts are more likely to still use older authentication methods.
2. Choose where passkeys will live. For most employees, a phone or assigned Windows PC will work. For shared workstations, cash desks, shop floors, or other shared environments, consider a physical security key.
3. Tell your team before Microsoft does. A sign-in prompt asking users to change how they authenticate is exactly the kind of thing security training tells them to distrust. Tell staff in advance that the prompt is legitimate, when it will start appearing, and which device or security key they should use.
4. Treat the SMS exception as an exception. If a specific system or regulation requires SMS or voice authentication, document the requirement and budget for the third-party provider. Do not pay to preserve a weaker method just because it is familiar.

The practical deadline is September 1, 2026, when users start seeing the prompts. If JC Logic manages your Microsoft 365 environment, we can identify the accounts still using SMS or voice codes, choose the right passkey method for each use case, and prepare the rollout before those prompts start.