Last week Microsoft announced a fairly big change to how people sign in to Microsoft 365. From 1 September 2026 passkeys become the default sign-in method, and from 1 February 2027 Microsoft will stop sending sign-in codes by text message or voice call altogether.
If your staff get a six-digit code by text when they log in, this affects you. If they use the Microsoft Authenticator app (or something similar) but have a mobile number registered as a backup - which is most people - it affects you too, just less urgently.
The 30-second version
Between now and the end of January, anyone who relies on text message codes needs to set up something else. For most businesses that something else will be a passkey on their phone or laptop. Do nothing and your staff will start seeing prompts from September, and from February anyone with only a phone number registered won’t get into their account until they’ve set up a passkey.
What’s changing, and when
- 1 September 2026. Anyone set up for text or voice codes is automatically enabled for passkeys and asked to create one next time they sign in. For now they can skip it, as many times as they like.
- 18 September 2026. Microsoft publishes the list of third-party providers, and their pricing, for organisations that want to keep text message codes.
- 30 October 2026. Those providers become available to set up.
- 1 February 2027. Microsoft stops sending text and voice codes. Users with nothing else registered get a prompt they can’t skip.
There is a temporary opt-out for the September to January period, but it doesn’t move the February date. February is happening either way.
OK, but what’s a passkey?
A passkey replaces the code with something your device does for you. You sign in by unlocking your phone or laptop the way you already do - fingerprint, face or PIN - and the device proves to Microsoft that it’s you. There’s no code to type, and nothing for a fake login page to steal.
That last bit is the whole point. Text message codes made a huge difference when they first arrived, but criminals worked out years ago that a convincing fake login page can simply ask for the code and use it in real time. A passkey only works on the genuine Microsoft sign-in page, so a fake page gets nothing useful.
This is one of those rare Microsoft changes we’re fully behind. It’s free, it’s more secure, and once it’s set up it’s quicker than waiting for a text and works even if you’re in the part of the office near the lift with no mobile signal.
Where it gets awkward
For most users this is a five-minute job. The trickier cases:
Your admin accounts. Check every admin account has at least two ways in, ideally including a security key kept somewhere safe. You really don’t want to find out in February that the only route into your admin account was a text message to someone who left two years ago.
Shared accounts on a shared phone. The classic is an info@ or accounts@ mailbox with its own password, where the sign-in code goes to the out of hours support mobile. A passkey is tied to a device and a person, so this setup doesn’t carry over neatly. The usual answer is converting the account to a shared mailbox that staff open through their own accounts - which is how it should have been set up in the first place. As a bonus, a shared mailbox under 50GB doesn’t need its own licence, so this change could save you money too.
Staff who don’t want work things on their personal phone. A fair position, and a common one. The alternatives are a passkey on their work laptop through Windows Hello, or a physical security key: a small USB or NFC key on a keyring costing a few tens of pounds.
Where the passkey is stored. By default Microsoft allows “synced” passkeys, which live in Apple’s iCloud Keychain or Google Password Manager and follow the person across their devices. That’s convenient, but it means a work credential sits inside someone’s personal Apple or Google account. For many small businesses that’s a reasonable trade-off. For those with higher security baselines (like family offices, or any firm with a regulator or demanding clients asking questions) you’ll probably want to restrict staff to passkeys that stay on one device - the Authenticator app, Windows Hello or a security key. Make that decision before September. Once people have registered synced passkeys, unpicking them is a chore. If you have an IT provider, this is one for them: they should be able to tell you which option suits your business.
Can we just keep text messages?
Sort of. From the end of October you’ll be able to sign up to a third-party provider through Microsoft and keep text and voice codes running, paid per message. Pricing hasn’t been published yet.
Unless you have a subset of users who are determined not to change and are senior enough to force the situation - yes, we’re talking about “those” senior staff, and we realise that may be you, reader! - we wouldn’t bother preserving the status quo. You’ll be paying extra to keep the weakest option.
What to do now
Find out who’s affected. Ask whoever manages your Microsoft 365 platform to run a report identifying the users with a mobile registered for authentication: they are the users to focus on.
Agree which passkey types you’ll allow. Synced, device-only, or a mix - take advice from your IT provider. See above.
Tell your staff before Microsoft does. A short email explaining what the prompt is, that it’s genuine, and what to do saves a lot of “is this a scam?” messages. Ironically, that’s exactly the instinct you want them to have.
Sort out the awkward cases. Shared accounts, admin accounts, and anyone without a suitable phone.
Get it done well before you break up for Christmas. You don’t want to be chasing people in January, when half of them have forgotten their PIN over the holidays.
If this sounds like a lot of work, or you’re not sure anyone is keeping an eye on it, we can check where you stand, set the right policies and handle the rollout for you. If you’d like us to take a look, get in touch.