Microsoft Is Retiring SMS Authentication - What to Do Before 2027
If your team gets a text message or a phone call to approve sign-ins to Microsoft 365, that's about to stop working.
Microsoft is switching off SMS and voice call authentication for good, and the transition is already underway.
Here's what's actually changing, why Microsoft is doing it, and what to do before it affects your business.
What's actually changing?
Microsoft is retiring SMS text messages and automated phone calls as a way to verify sign-ins and reset passwords across Microsoft 365 and Entra ID.
From 1 February 2027, Microsoft will stop providing these codes and calls entirely.
It's already starting before that date.
From 1 September 2026, anyone currently using SMS or voice for multi-factor authentication will begin being prompted to set up something more secure - specifically a passkey - the next time they're asked to verify a sign-in.
Why is Microsoft doing this?
Because a text message code isn't as secure as it used to be.
Microsoft's own research points to a rise in AI-assisted phishing and interception attacks specifically designed to catch and reuse SMS codes in real time - the kind of attack that a one-time text code was never built to withstand.
Passkeys work differently.
Instead of a code you type in, they're tied to your specific device - a fingerprint, a face scan, or a PIN - and can't be phished, intercepted, or reused elsewhere, even if someone tricks you into visiting a fake login page.
What does this mean for your business?
If nobody in your business uses SMS or voice codes for Microsoft 365 sign-in already because you're on the Microsoft Authenticator app, or on Windows Hello, this changes very little for you directly.
If you do still rely on text or call-based verification, this matters.
Come February 2027, that method simply won't work anymore.
Between now and then, your team will start seeing prompts to register a passkey instead, whether you've planned for it or not.
Left unmanaged, this tends to show up as confused staff getting unexpected security prompts, and no clear process for getting everyone switched over before it becomes mandatory.
What should you do before the deadline?
Check who's still using SMS or voice authentication across your business — most organisations don't have a clear view of this without checking directly.
Start moving people to Microsoft Authenticator or Windows Hello for Business now, rather than waiting for Microsoft's prompts to force the issue.
Plan for devices that don't support biometrics — older hardware may need a different passwordless method, or replacing before the deadline.
Communicate the change to your team before it happens, so a security prompt doesn't get mistaken for a phishing attempt
(which, ironically, is exactly the kind of confusion attackers rely on).
What if you can't move to passkeys yet?
Microsoft has confirmed there's a route for businesses with a genuine regulatory or operational reason they can't move away from SMS or voice.
A third-party telecoms provider option through the Microsoft Security Store, with details due to be published from 18th September 2026 and available to configure from 30th October 2026.
It's positioned as the exception, not the default, and is expected to come with additional cost.
For the vast majority of UK SMEs, moving to passkeys before the deadline will be the simpler and cheaper route.
How RefynIT can help
This is exactly the kind of change that's easy to miss if nobody's specifically watching for it — a policy update from Microsoft, rolling out gradually, with a deadline over a year away that's easy to file under "later."
Our Microsoft 365 management service includes exactly this kind of proactive tracking — identifying who in your business is still on an authentication method that's being retired, and getting everyone moved over properly before it becomes urgent, rather than reacting once Microsoft starts locking people out. It's part of the same managed IT support approach behind everything we do: catching this kind of change before it becomes your problem.
Get in touch and we'll check where your business actually stands.
