Microsoft Is Retiring SMS and Voice MFA: What Your Business Needs to Do Before 2027
From Monday 1 February 2027, Microsoft will stop sending the six-digit codes that arrive by text message or automated phone call when your staff sign in to Microsoft 365. Those codes are one form of multi-factor authentication (MFA), the second check after a password that confirms the person signing in really is your employee.
If anyone in your business signs in with a texted code and has no other way to confirm who they are, this change affects you. From February, those people won't be able to sign in until they set up a passkey. A passkey is a newer way to confirm your identity: instead of typing a code, you use the fingerprint, face scan or PIN you already use to get into your phone or laptop. Staff who already approve sign-ins in the Microsoft Authenticator app, or sign in to their laptop with Windows Hello, will barely notice the change.
For most businesses, getting ready takes a few weeks, and the best time to do it is before the Christmas shutdown. If you leave it until February, you'll be sorting it out on the first working mornings of the year, while affected staff are all trying to get back into their email at once.
What Microsoft is changing, and when
Microsoft is making the change in stages. The first stage started on 1 September 2026, when Microsoft began asking staff who use text or phone call codes to set up a passkey after they sign in. By default, staff can dismiss that request as many times as they like, so many will have tapped "not now" and carried on.
On 1 February 2027, Microsoft stops sending text message and phone call codes for almost everyone. After that date, anyone whose only option is a text or a call will see a screen they can't skip, asking them to set up a passkey before they can continue. Microsoft has said there is no way to opt out of this.
Two groups get until 1 July 2027. The first is Global Administrators, the small number of accounts that have full control over your Microsoft 365 setup. The second is external users, meaning people from other organisations you've given access to your files or Teams. The change also covers self-service password reset, so staff who reset a forgotten password with a texted code will need another way to do it.
Microsoft says nobody will be locked out, because staff can set up a passkey on the spot when the screen appears. That's true for someone sitting at their laptop with a recent smartphone. It's much harder for a receptionist on a shared computer, a staff member who has just replaced their phone, or someone who doesn't have a smartphone at all. Those are the people to plan for.
Why Microsoft is dropping text message codes
Microsoft describes text and phone call codes as among the most vulnerable sign-in methods available today. The problem is that a person can be tricked into handing a code over. Criminals send emails that link to fake Microsoft sign-in pages, and when an employee types their password and code into the fake page, the criminal uses both on the real site within seconds. Criminals can also take over a phone number by convincing the phone company to move it to a SIM card they control (a "SIM swap"), after which every code goes to them.
A passkey can't be handed over this way. It only works on the genuine Microsoft website, so a fake page has nothing to collect, and there's no code for anyone to read out or forward.
There's also an Australian compliance reason to move. The Essential Eight is the set of baseline cyber security controls published by the Australian Signals Directorate (ASD), and many businesses, insurers and larger clients use it as a benchmark. In the current version of ASD's Essential Eight maturity model (November 2023), the middle level, Maturity Level Two, requires MFA that a fake website can't trick, which ASD calls phishing-resistant MFA. ASD's own assessment guidance lists passkeys and physical security keys as methods that qualify. Text messages and phone calls don't.
Who in your business needs attention
The people to focus on are those whose only sign-in method is a mobile number. That often includes someone who set up MFA years ago and never changed it, contractors who were added in a hurry, and shared accounts (such as a reception or accounts mailbox) whose codes go to one person's phone. It also includes staff who have chosen not to install work apps on their personal phones.
Administrator accounts deserve early attention even though Microsoft gives them until July. They're the accounts criminals most want to get into, so we'd move them to passkeys first.
What passkeys will look like for your staff
There are three common ways to use a passkey with Microsoft 365, and most businesses use a mix. Staff with a company Windows laptop can use Windows Hello, which signs them in with their face, fingerprint or a PIN on that laptop. Staff with a smartphone can store a passkey in the Microsoft Authenticator app and confirm sign-ins with the same face or fingerprint check they use to get into the phone. For everyone else, there are hardware security keys: small devices about the size of a house key that plug into a computer or tap against a phone.
Our recommendation for most businesses is Windows Hello on company laptops plus a passkey in the Authenticator app for phones. Hardware keys then cover the gaps: shared computers, staff without a suitable phone, and anyone who won't put a work app on a personal device. We'd also give administrators a hardware key.
A plan that works around Christmas
Counting from mid-October, there are about 15 weeks until 1 February, and the holiday break takes a large piece out of them. A realistic aim is to have every active staff member set up before the business closes for Christmas, leaving January for anyone who was on leave or missed the deadline.
In October, have your IT provider list everyone who still relies on text or phone call codes. Microsoft provides a free tool for this, and any result above zero means your business is affected. At the same time, decide which of the three passkey options each group of staff will use.
In November, test the change with a small group, such as your IT contact and two or three volunteers from the business. Order any hardware keys you need, and prepare short staff instructions with screenshots from your own setup.
In early December, switch on the passkey request for everyone on the list and send your staff the instructions. Follow up every week with anyone who hasn't done it. In January, deal with the exceptions: people back from leave, new starters and external users.
Two things make the rollout smoother. First, tell staff before the prompt appears on their screen. Microsoft recommends three messages: one explaining what's changing and why, one with step-by-step instructions for each type of device, and a reminder for anyone who hasn't finished. Microsoft publishes ready-made email and Teams templates you can adapt. Second, decide in advance how you'll help someone who has lost or replaced their phone. Your IT provider can issue a Temporary Access Pass (a short-lived code that expires automatically) after confirming the person's identity, so they can set up a new passkey without waiting.
If your business genuinely needs text messages
A small number of organisations have a regulatory or practical reason to keep phone-based codes for some staff. From 30 October 2026 they can pay an outside provider (Soprano and Telesign are the first two) to keep sending codes, and Microsoft asks them to document why each group still needs them. For most businesses the cost and paperwork aren't worth it.
What to do this week
1. Ask your IT provider how many of your staff still rely on text or phone call codes to sign in, and who they are.
2. Check that your Global Administrator accounts already use something stronger than a text message.
3. Identify the shared computers and staff without a suitable phone, so you know how many hardware keys you might need.
4. Put a date before Christmas in the diary for staff to have their passkeys set up.
If you'd like help, our cybersecurity team can find out who still relies on text codes, recommend the right passkey option for each group of staff and run the rollout through to February, including hardware keys and staff instructions.
Sources and further reading
Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
Microsoft Learn: Frequently asked questions about SMS and voice retirement
Microsoft Learn: Plan a passkey deployment in Microsoft Entra ID (for your IT team)
Microsoft Learn: Choose a telephony provider for SMS and voice authentication
Microsoft staff communication templates
ASD: Essential Eight maturity model changes (November 2023)
FAQs
Will my staff be locked out on 1 February 2027?
Staff who already use the Authenticator app or Windows Hello will sign in as normal. Staff whose only option is a text or phone call will see a screen that stops them until they set up a passkey. If they don’t have a suitable device with them, they’ll need help from your IT provider before they can get back to work.
Does switching to passkeys cost anything?
Microsoft says moving from text codes to passkeys carries no additional cost. The only likely expense is hardware security keys for staff who can’t use a phone or laptop, plus the time to roll the change out.
Can we keep using text message codes?
Only by setting up a paid outside provider through Microsoft, available from 30 October 2026. Microsoft expects you to document why those staff need text codes, so it suits regulated or unusual situations rather than convenience.
What if a staff member won't install work apps on their personal phone?
Give them a hardware security key or have them use Windows Hello on a company laptop. Both work without any app on a personal phone.
Does this affect personal Microsoft accounts?
No. Microsoft’s announcement covers Microsoft Entra ID, the sign-in system behind the work and school accounts businesses use for Microsoft 365. It doesn’t cover personal Microsoft accounts such as Outlook.com.