Guide · Microsoft 365

Microsoft 365 is ending text-message codes: what to do before February

If your team signs in to Microsoft 365 with a code sent by text, that stops working on 1 February 2027. Microsoft is replacing it with passkeys, and has already started prompting people to set one up. For a small business with nobody in charge of IT, the risk is a Monday morning of staff stuck at a sign-in screen. Here is what is changing and a three-month plan to get ahead of it.

By Elliot · Published 26 October 2026 · 9 min read

Key points

Text and voice-call codes for work accounts end on 1 February 2027, password resets included.
Anyone with no other method will have to set up a passkey at their next sign-in.
Passkeys cost nothing extra on any Microsoft 365 plan.
Find out who relies on texts now, and move them over before the deadline does it for you.

What is changing

Microsoft stops sending the codes, and pushes passkeys

Microsoft 365 sign-ins are run by Microsoft Entra ID, which used to be called Azure Active Directory. For years it has offered a code by text message or phone call as the second step after a password. In July Microsoft said it would stop delivering those codes itself, and make passkeys the default way to sign in instead.

The change is already under way, tenant by tenant. Since 1 September, people enabled for text or voice codes have had passkeys switched on for them and see a prompt to register one after they sign in, which they can snooze. On 1 February 2027 the snooze ends for anyone whose only method is a text or call. Microsoft gives security as the reason: those channels are increasingly intercepted and phished.

The change at a glance, from Microsoft's current documentation
What ends	Microsoft sending codes by text message or voice call for work and school sign-ins, including password resets and text-message sign-in
When	1 February 2027 for most people. 1 July 2027 for Global Administrators and external users
Which accounts	Every Microsoft Entra ID work or school tenant in Microsoft's public cloud, whatever the Microsoft 365 plan
If text is someone's only method	They are not locked out. At sign-in they must set up a passkey before they can carry on
If they also use Authenticator	They keep working, with reminders to add a passkey that they can put off
Cost of the replacement	Passkeys are included in every edition of Microsoft Entra ID, the free one too
Keeping text codes	Only through a paid third-party telephony provider, set up in your own Azure subscription

The timeline

Three months left, with two deadlines

Dates from Microsoft's notices, including the September update that split them.

1 Feb

2027: text and voice codes end for most work and school users

Source: Microsoft Learn

1 Jul

2027: the same for Global Administrators and external users

Source: Microsoft Learn

£0

extra for passkeys, on every Microsoft Entra ID edition

Source: Microsoft Learn

From announcement to the last deadline
13 July 2026	Microsoft announces passkeys as the default and the end of its own text and voice codes
11 August 2026	Text-message sign-in, with no password, retired for tenants on the free Entra ID tier
1 September 2026	Rollout begins: people with text or voice enabled get passkeys switched on and are prompted to register one
15 September 2026	Microsoft updates its notice, adding the later date for administrators and external users
30 October 2026	Organisations with a real need to keep text codes can start setting up a third-party telephony provider through Microsoft Security Store
1 February 2027	Text and voice codes end for most users. Text-message sign-in ends for all workforce tenants
1 July 2027	Text and voice codes end for Global Administrators and external users

If you read Microsoft's July announcement on its own, you will see one date for everyone. Its documentation, updated in September and October, adds the later July 2027 date for administrators and outside guests. Where the two differ, we have followed the newer pages, and we would check them again before acting on anything close to a deadline.

Who it affects

How each person in the business is affected

It depends on the sign-in methods each person has set up, not on your plan.

Staff who only ever get a text

These are the people the deadline really hits. From 1 February 2027 their next sign-in stops at a screen that insists on a passkey. If they do not have a suitable phone with them, or are setting it up on a busy Monday morning, that is a lost hour.

Staff who use Microsoft Authenticator

Anyone who already approves sign-ins in Authenticator, or types a code from an authenticator app, keeps working after the deadline. They will see reminders to add a passkey, which they can put off. Authenticator and app codes are not being retired.

Password resets by text

Microsoft's own FAQ says the retirement covers self-service password reset too. If your team resets forgotten passwords with a code sent to their mobile, that route stops on the same date. Do not assume reset texts carry on.

Staff without a smartphone

A passkey usually lives on a phone or computer, but a small USB or NFC security key does the same job and costs little. An administrator can also issue a Temporary Access Pass, a short-lived code that lets someone sign in once to set up their new method.

Administrators and outside guests

Global Administrators and external users have until 1 July 2027. Do not use the extra time. Administrator accounts are what attackers want most, and Microsoft recommends moving them to passkeys first, with two emergency access accounts kept aside.

Personal Outlook.com accounts

Every Microsoft notice about this change is about work and school accounts. None mentions personal Microsoft accounts, which have their own, separate passkey push. We have found nothing saying text codes are ending there, so we make no claim either way.

What to do

A plan for the next three months

Steps one, two and five need a Microsoft 365 administrator. Steps three and four are for the whole team, and take each person a couple of minutes.

Find out who still relies on texts

On Microsoft 365 Business Premium, open the Microsoft Entra admin centre and go to Authentication methods, Activity; the registration details list who has what. On Business Basic or Standard that report is not included, so check people individually under Users, [name], Authentication methods, or run the free script Microsoft publishes for this. Any non-zero result means you are in scope.

Switch passkeys on for everyone

In Authentication methods, Policies, Passkey (FIDO2), enable it for all users and allow self-service set-up. Microsoft has been switching this on automatically for tenants with text users since 1 September, so it may already be done; check rather than assume. This needs an administrator with authentication policy rights.

Tell the team before the prompts do

A short message, then a reminder, then a deadline. Microsoft publishes ready-made templates. Staff who know what a passkey is and why the prompt appeared will set one up in two minutes; staff who think it is a scam will ignore it, and some will ring you on 1 February.

Have each person register a passkey

The simplest route is the Microsoft Authenticator app: add the work account, then choose to create a passkey. Or go to mysignins.microsoft.com, open Security info and add a passkey. A recent iPhone or Android phone is needed for the Authenticator route; a laptop can use the phone over Bluetooth.

Sort out the people without a phone

Buy security keys for anyone who cannot or will not use a personal phone, and issue a Temporary Access Pass to help them register. Do this before the deadline, not on the day. Then move both Global Administrator accounts to passkeys, even though they have until July.

Do not plan around the opt-out

Microsoft offers a temporary opt-out from the automatic changes, but only through its Graph programming interface, with no button in the admin centre, and it ends on 1 February 2027 anyway. There is no opt-out from the deadline itself. Use the next three months to move people, not to delay them.

Reading the small print

Where Microsoft's own pages disagree

The July blog says passkey prompts will be enforced for everyone with no opt-out. The later documentation is more precise: the enforced, unskippable prompt is only for people whose sole method is a text or call, everyone else gets reminders they can postpone, and there is a temporary opt-out from the automatic changes until the deadline. Coverage that says “everyone will be locked out” is wrong, but so is coverage that says nothing will change.

One question Microsoft has not answered directly: most small businesses use security defaults, the free baseline settings, and we could not find a current Microsoft statement that a passkey satisfies the security-defaults sign-in check. Everything about the rollout implies it does, since passkeys are being switched on for every tenant with text users. If you rely on security defaults, test one account first.

Microsoft's passkey success figures, such as faster and more reliable sign-ins, come from personal Microsoft accounts, not work ones, so we have not quoted them as if they applied to your team. And the NCSC recommends passkeys rather than requiring them. That is reason enough: it ranks codes sent by text, email or phone call as the weakest form of multi-factor authentication there is.

FAQ

Text codes and passkeys, answered

Is Microsoft stopping text message codes for Microsoft 365?

Yes, for work and school accounts. Microsoft is retiring the text-message and voice-call codes it sends for Microsoft Entra ID sign-ins on 1 February 2027, and on 1 July 2027 for Global Administrators and external users. This covers sign-in checks and password resets. Organisations can keep text codes only by contracting a third-party telephony provider, which Microsoft positions for regulatory or operational needs.

What happens to staff who only use text codes after 1 February 2027?

Microsoft says they will not be locked out. Instead, when they next sign in they will be required to register a passkey before they can continue, with no way to skip it. Staff who already have another method, such as Microsoft Authenticator or an authenticator app code, can keep signing in and will see reminders they can postpone.

What is a passkey?

A passkey is a way to sign in that uses your phone, computer or a security key, unlocked with your fingerprint, face or PIN, instead of a password and a code. It only works on the genuine website or app it was made for, so it cannot be phished. The NCSC recommends passkeys wherever a service supports them.

Do passkeys cost extra on Microsoft 365?

No. Microsoft says passkeys are available in every edition of Microsoft Entra ID, including the free tier that comes with Microsoft 365 Business Basic and Business Standard, and that the move costs nothing extra. Some reporting, such as the authentication methods activity report, needs Entra ID P1, which is included in Business Premium.

Can we keep using text messages for sign-in?

Only by paying for it. Microsoft will support text and voice through third-party telephony providers bought via its Security Store, which can be set up from 30 October 2026 and which also needs a routing function in your own Azure subscription, with Azure charges. Text-message sign-in without a password ends on 1 February 2027 even with a provider. For a small business, moving to passkeys is simpler and cheaper.

Does this affect my personal Outlook.com or Hotmail account?

Microsoft's notices about this change apply to Microsoft Entra ID work and school accounts. None of them mentions personal Microsoft accounts, which have had their own move to passkeys since 2025. We found no statement that text codes are ending for personal accounts.

Why is Microsoft retiring text message codes?

Microsoft says text and voice codes rely on channels that attackers increasingly intercept, phish or manipulate, and that SIM swapping and other ways round them have become easier. The UK's NCSC has long ranked codes sent by text, email or phone call as the weakest kind of multi-factor authentication, to be used only when nothing stronger is possible.

References