Microsoft 365 Text Message Sign-In Codes End Feb 1, 2027: What Your Team Needs to Do

If your team signs in to Microsoft 365 with a six-digit code that shows up as a text, or a phone call that reads it out, that’s ending. In our latest video, Jason and Mabel from ADVYON walk through the questions your staff will ask when the “set up a passkey” prompt shows up. This post covers the same ground in writing, so you can share it with your office manager or forward it to the team.

Is Microsoft getting rid of text message codes for Microsoft 365?

Yes, for work and school accounts. Microsoft’s official notice says: “From February 1, 2027, Microsoft-provided telephony delivery for SMS and voice will be retired for all users except Global Administrators and external users” (Microsoft Learn). That covers Microsoft Entra ID, the sign-in system behind Microsoft 365 work accounts, in Microsoft’s public cloud.

Microsoft’s reason is security. Text and call codes can be phished, and they can be stolen in SIM-swap scams, where a criminal talks a phone carrier into moving your number to their phone. Microsoft is making passkeys the default sign-in instead. The announcement is about work and school accounts. It doesn’t address personal accounts like Outlook.com.

When do Microsoft’s text message sign-in codes stop working?

• September 1, 2026: passkeys were turned on automatically for people who use text or call codes. Many of them now see a “register a passkey” prompt after they sign in, and right now they can skip it.
• February 1, 2027: Microsoft-provided text and call codes retire for most users, including internal guest users.
• July 1, 2027: the same change reaches Global Administrators and external (outside) users.

Password resets are part of this too. If your staff reset their own passwords with a text code, Microsoft says the retirement applies to self-service password reset as well.

Will my employees get locked out of Microsoft 365?

Not locked out, but stopped. Microsoft’s FAQ answers this directly: customers won’t be locked out. Instead, after February 1, anyone whose only sign-in method is a text or call gets a blocking prompt and has to set up a passkey before they can keep going. The skip button goes away, and there’s no opt-out from that step (Microsoft Learn FAQ).

Picture your receptionist at 8 a.m. on a Monday, phones ringing, coffee going cold, stuck setting up a passkey for the first time. That’s the moment you want to avoid. Doing it now means people can take their time.

What is a passkey, in plain English?

A passkey is a sign-in that lives on your phone or computer. Instead of typing a code, you use your face, your fingerprint or a PIN, just like unlocking your phone. There’s no code to read off a screen, so a scammer can’t talk anyone into handing it over.

A passkey can live in a few places:

• The Microsoft Authenticator app on your phone
• Windows Hello on your PC
• The password manager on your iPhone or Android (iCloud Keychain or Google Password Manager)
• A small security key on your keychain

Do Microsoft Authenticator app codes still work after February 1, 2027?

Yes. Microsoft says the six-digit codes generated inside the Authenticator app (or a similar authenticator app) stay supported after February 1, and people who use them won’t get the blocking prompt. They aren’t as strong as a passkey, though, and your company’s security settings can require something stronger. If you’re picking one for your team, a passkey is the better long-term choice.

What should our business do before February 1? The 3-step plan

1. Find out who still only uses text or phone codes. Microsoft gives your IT admin a tool to pull that list. Microsoft says any result above zero means your company is affected.
2. Get those people on a passkey or the Authenticator app before the deadline. Send a short heads-up email first, so nobody thinks the prompt is a scam. Microsoft also lets your admin turn on a “registration campaign” that nudges people to set one up when they sign in. Bringing sweet tea to the setup session is optional, but it helps.
3. Plan for the curveballs: new phones, lost phones and shared accounts (more on those below).

Treat it like hurricane prep: easy in November, a scramble the night before. If your business runs on Microsoft 365, our Microsoft 365 services page explains how we support it day to day.

Can we just keep using text message codes?

Only by contracting with an outside text and call provider through Microsoft Security Store. Microsoft lists Soprano and Telesign as the first ones, and it says those providers cost money while moving to passkeys doesn’t. That option is meant for businesses with a real regulatory or operational need. For most small offices, passkeys are simpler.

Frequently asked questions

What happens if someone gets a new phone?

Plan it before the old phone gets traded in. Some passkeys sync to the new phone through your Apple or Google account. Others, like the passkey in Microsoft Authenticator, stay on the original device, so you’ll set up a fresh one on the new phone. Set up the new phone before you wipe the old one.

What if an employee loses their phone?

Call IT right away so they can shut off the sign-in on the lost phone and help set up a new one. It’s the same idea as a good employee offboarding process: remove access you no longer control.

What about a shared front-desk login that texts one person’s phone?

That’s the one that sneaks up on people. If a shared sign-in sends its code to one person’s cell, it needs a plan before February 1. The cleanest fix is usually one person, one account.

Who gets until July 1, 2027?

Only active Global Administrators (the top-level admin role) and external users. Everyone else, including internal guest users, follows February 1, 2027.

Can we opt out of the change?

Not really. Microsoft offers a temporary opt-out that only delays the passkey prompts between September 2026 and February 2027. There’s no opt-out from the February 1 enforcement.

Does this change personal Microsoft accounts like Outlook.com?

Microsoft’s announcement covers work and school accounts that sign in through Microsoft Entra ID. It doesn’t address personal accounts, so check Microsoft’s guidance separately for those.

Need a hand getting your team ready?

ADVYON has helped Lowcountry businesses since 2008, from our offices in Summerville and Mt Pleasant. Book a free Discovery Meeting, and we’ll walk through your team’s sign-in setup with you and help you build a plan before February 1. Call (843) 324-5824 or visit advyon.com.

For more on keeping logins safe, see our managed security services.

Sources

• Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
• Microsoft Learn: FAQ for Microsoft-provided SMS and voice retirement
• BleepingComputer: Microsoft urges Entra ID admins to migrate users to passkeys (Oct 28, 2026)

The hosts in the video are AI-generated presenters.