Microsoft Is Retiring Text-Message Sign-In Codes. Here’s Your To-Do List.

November 9, 2026

Starting February 1, 2027, Microsoft will stop sending its own text-message and phone-call sign-in codes for Microsoft 365 and other services that use Microsoft Entra ID. If some of your people still confirm their logins with a code texted to their phone, they’ll need a new method, and the prompts nudging them to switch are already showing up.

What’s changing

Microsoft Entra ID (formerly Azure Active Directory) is the sign-in system behind Microsoft 365. One of its multifactor authentication (MFA) options has long been a code sent by text (SMS) or an automated voice call, delivered by Microsoft. That built-in option is being retired in two phases:

February 1, 2027: most users, including internal guest accounts.
July 1, 2027: Global Administrators and external users, such as partners who sign in to your Microsoft 365 environment.

The change covers sign-in verification and self-service password reset. Since September 1, Microsoft has been turning on passkeys for affected users and prompting them to set one up when they sign in. For now, they can click “skip.” After the cutoff, users whose only method is SMS or voice must register a passkey before they can get in.

A passkey replaces the typed code with your device’s own unlock, such as a fingerprint, face scan or PIN. It’s tied to the real sign-in page, which makes it far harder to phish than a six-digit code someone can be talked into reading aloud.

The catch: not every device is ready

In a November 5 update, Microsoft warned that users who rely only on SMS or voice and sign in from a browser, device or app without passkey support may be blocked from completing MFA in that session and need an administrator’s help. Microsoft also described the dates as the start of a phased rollout and said it can’t tell each organization exactly when the change will reach it.

Translation: plan for February 1, not for the day it happens to land. Shared workstations, older tablets and the conference-room PC nobody admits to owning are good places to start testing.

Your options

Passkeys on phones or computers, including in Microsoft Authenticator. Microsoft says passkeys are included in all Entra plans at no extra cost.
FIDO2 security keys, small USB or NFC keys made by several manufacturers. Useful for staff without a company phone and for shared workstations.
Authenticator app codes. These work, though Microsoft notes they aren’t phishing-resistant.
Keep text codes through a third-party telephony provider offered in the Microsoft Security Store. The provider charges for this.

What we recommend

Find out who’s affected. Microsoft publishes a free, read-only analyzer script on GitHub, and the Entra admin center’s User registration details report shows each user’s methods.
Start with your admins. Their deadline is July, but they’re the ones who will field the lockout calls in February.
Test where people actually sign in: browsers, shared PCs, rugged devices and older phones.
Decide on a plan for people without smartphones and budget for security keys early.
Tell users before February that “skip” has an expiration date.

How DTM can help

If your inventory turns up users or devices that need something new, we can help you compare security keys from multiple manufacturers, replace devices that can’t support passkeys, and review your Microsoft licensing along the way. Your dedicated DTM contact can help you sort out what you need without pushing a particular brand.

Questions about getting your team ready? Contact us.

Dates and details are based on Microsoft’s published guidance as of November 9, 2026 and could change; Microsoft says rollout timing may vary by organization.

Sources

Tell us what you need.

Every relationship starts with a conversation.

Talk to us