Microsoft Is Retiring Text-Message Login — Here’s What Your Business Needs to Do
Friday, September 4, 2026
If your team logs into Microsoft 365 with a text message or phone call code, that login method is going away. Microsoft has set a firm timeline to phase out SMS and voice authentication in favor of passkeys — a stronger, phishing-resistant way to sign in. This isn’t a distant announcement buried in a changelog. It’s a dated rollout already underway, and businesses that don’t plan for it risk sign-in disruptions and a scramble at the worst possible time: right when the deadline hits.
The Timeline Business Owners Need to Know
- September 1, 2026: Passkeys become the default sign-in method. Anyone currently using text or voice codes will be automatically enrolled and prompted to set up a passkey the next time they sign in.
- October 30, 2026: Businesses with a genuine regulatory, technical, or operational need to keep SMS or voice login can configure a third-party telecom provider through the Microsoft Security Store — at their own cost.
- February 1, 2027: Microsoft-provided text and voice authentication stops working entirely for any business that hasn’t set up an alternative. No exceptions, no grace period.
The rollout is gradual, so not every business will see the change on day one. But once it reaches your tenant, waiting is not a strategy — it’s a risk.
Why Microsoft Is Making This Change
Text and voice codes can be intercepted, forwarded, or socially engineered — attackers have gotten very good at tricking employees into handing codes over. Passkeys close that gap. Instead of a code that can be stolen, a passkey uses a security key, a fingerprint, or a device credential that never leaves your employee’s device. It’s a meaningful upgrade in protection against the kind of phishing and social engineering attacks that account for a large share of business breaches today.
What This Means for Your Business
Nobody wants to find out their login method stopped working in the middle of a Monday morning. The businesses that come through this transition smoothly are the ones who plan for it now — identifying who’s still using text or voice login, rolling passkeys out on their own timeline, and giving employees a heads-up before Microsoft starts nudging them automatically.
Under our Total Technology Confidence™ plans, staying ahead of changes like this is already part of what we do — not a separate project you have to remember to schedule or pay for separately. We track vendor changes like this across every system you rely on, so your business isn’t the one finding out the hard way.
Frequently Asked Questions
Do we need to do anything before September 2026?
If any of your team currently signs in with a text message or phone call code, yes. Planning ahead of the automatic rollout means your team registers passkeys on your schedule, not during a rushed sign-in prompt.
What exactly is a passkey?
A passkey is a passwordless, phishing-resistant way to sign in using a device credential, security key, or biometric (like a fingerprint or face scan) instead of typing in a code that was texted or called in.
Will our employees have to change how they work?
The sign-in process changes slightly — a prompt on a device or a fingerprint instead of typing a code — but it’s designed to be simpler, not harder, once it’s set up.
What if we have a legitimate reason to keep using text or voice login?
Starting October 30, 2026, businesses with a real operational, technical, or regulatory need can configure a third-party telecom provider to keep that option — though it comes with its own contract and cost outside of Microsoft’s platform.
What happens if we ignore this and do nothing?
After February 1, 2027, Microsoft-provided text and voice login stops working. Anyone still relying on it as their only method will be blocked from signing in until they register a passkey.
Not sure who on your team is still using text or voice login? Talk to us and we’ll help you get ahead of the deadline.