Microsoft Is Retiring Text and Phone Call MFA. Is Your Business Ready for Passkeys?

Article summary: Microsoft is retiring its built-in text and phone call authentication services for most business users on February 1, 2027. Passkeys offer a more secure alternative, protecting against phishing and SIM swapping. Preparing employees now can help prevent sign-in disruptions and strengthen Microsoft 365 account security.

For years, employees have relied on six-digit text messages or phone calls to verify their identities when signing in to Microsoft 365.

But Microsoft is encouraging businesses to move toward stronger authentication methods, including passkeys, that offer better protection against phishing and account compromise.

If your employees still rely on texted verification codes, now is a good time to review your sign-in methods and prepare for a more secure alternative.

With the right IT support, your business can make the transition smoothly while strengthening account security.

What Is Microsoft Changing, and When?

Microsoft Entra ID manages employee identities and access to Microsoft 365 services like Outlook, Teams, and SharePoint.

In July 2026, Microsoft announced plans to make passkeys the default authentication method and retire its built-in text message and phone call verification services.

According to Microsoft’s official timeline, the transition includes three important dates:

• September 1, 2026: Microsoft begins automatically enabling passkeys for users configured for text or voice verification and prompting them to register.
• February 1, 2027: Microsoft-provided text and voice authentication ends for most users, including internal guest accounts.
• July 1, 2027: The retirement extends to Global Administrators and external users.

After the applicable deadline, employees who rely exclusively on Microsoft’s text or voice verification must register a passkey to continue signing in, unless their organization has configured a supported alternative.

Businesses that still require phone-based verification can arrange service through an approved third-party provider. However, Microsoft recommends moving to phishing-resistant authentication methods, such as passkeys, whenever possible.

Why Are Text and Phone Call Codes Going Away?

Text messages and phone calls provide an extra layer of security, but they’re vulnerable to attacks that can expose verification codes.

For example, SIM swapping allows criminals to hijack a phone number and intercept incoming messages. Phishing attacks can also trick employees into entering verification codes on fake login pages, giving attackers an opportunity to access their accounts.

Phone call verification carries similar risks because attackers who gain control of a phone number may receive authentication calls.

CISA recommends phishing-resistant MFA to address these weaknesses and better protect business accounts.

Text and voice verification are still better than relying on passwords alone, but stronger authentication methods offer greater protection against modern threats.

How Do Passkeys in Microsoft 365 Work?

Passkeys replace traditional passwords and verification codes with a more secure way to sign in. Instead of entering a code, employees can use a fingerprint, facial recognition, or device PIN to authenticate.

Behind the scenes, passkeys use two cryptographic keys. A private key is securely stored on the user’s device or within a credential provider, while a matching public key is registered with Microsoft. During sign-in, the private key proves the user’s identity without being shared.

This approach provides two important security benefits:

• No codes to intercept: Authentication doesn’t rely on text messages or phone calls that attackers could hijack.
• Protection against phishing: Passkeys are tied to legitimate websites, preventing attackers from using them on fraudulent login pages.

The FIDO Alliance, which develops authentication standards, highlights how passkeys use security features already available on modern devices.

Passkeys can also simplify everyday sign-ins. Fewer passwords and verification codes mean less frustration and reduced security fatigue for employees.

Getting Your Team Ready for Passkeys

Transitioning to passkeys in Microsoft 365 takes some preparation, but a few practical steps can make the process easier for everyone.

Review Current Authentication Methods

Start by identifying employees who still rely on text messages or phone calls for verification. Your IT provider can review Microsoft Entra authentication reports to determine which accounts need to transition.

Choose the Right Passkey Options

Microsoft Authenticator on a smartphone and Windows Hello on compatible work computers are options for passwordless authentication. Employees who share workstations or don’t have company-approved smartphones may benefit from physical FIDO2 security keys.

Choose methods that fit your employees’ devices, work environments, and security needs.

Prepare for Lost or Replaced Devices

Employees need a reliable way to regain access if their phone or security key is lost.

Set up approved backup authentication methods and establish a secure account recovery process. Document the steps so employees know who to contact and IT can verify their identities before restoring access.

Prioritize Administrator Accounts

Administrator accounts have elevated access to business systems and sensitive information, making them especially attractive targets.

Even though Microsoft’s retirement deadline for Global Administrators comes later, these accounts should be among the first to adopt phishing-resistant authentication. Following the principle of least privilege provides another important layer of protection.

Explain the Changes to Employees

Unexpected authentication prompts can confuse employees or resemble phishing attempts.

Before the rollout, explain what is changing, when employees should expect registration prompts, and how to recognize legitimate Microsoft sign-in requests. Clear instructions and a trusted IT contact can help employees make the transition confidently.

Ready to Make the Switch to Passkeys?

Microsoft’s February 2027 deadline is approaching, and preparing now can help your business avoid sign-in disruptions. Reviewing your authentication methods and planning the transition early will make the process easier for everyone.

C Solutions IT can assess your current sign-in methods, help implement passkeys in Microsoft 365, and guide your employees through the transition.

Contact C Solutions IT or call 407-536-8381 to get started.

Article FAQs

When is Microsoft ending text message MFA?

Microsoft will retire its built-in text and voice authentication services for most business users on February 1, 2027. Global Administrators and external users have until July 1, 2027.

What is a passkey?

A passkey is a secure sign-in method that uses a fingerprint, facial recognition, or device PIN instead of a password or verification code. It relies on cryptographic keys to verify your identity without exposing your private key.

Why are passkeys safer than text codes?

Text codes can be intercepted through SIM swapping or stolen through phishing. Passkeys are tied to legitimate websites, making them resistant to these attacks because there are no verification codes to steal.