The SMS code is on borrowed time: Microsoft switches to passkeys
Since 1 September 2026, Microsoft has changed the default sign-in method for Microsoft 365. The SMS code that many companies still use as a second factor is living out its last months: it will be retired on 1 February 2027 for the vast majority of users. If one of your staff members has only SMS to validate a sign-in, they will be locked out in front of their screen that day. Here is what changes and what you should prepare now rather than in a panic.
Three dates to put in your calendar
Microsoft announced the change on 13 July 2026 in its admin message centre (reference MC1426371). The timeline comes down to three deadlines.
1 September 2026: passkeys become the default authentication experience. Users still configured for SMS or voice call are automatically enabled for passkeys and are prompted to register one at their next multi-factor sign-in.
1 February 2027: Microsoft-provided SMS and voice calls are retired for the vast majority of users, internal guests included.
1 July 2027: the same retirement applies to global administrators and external users.
One escape route remains: you can keep sending SMS through a third-party telephony provider, configurable in the Microsoft Security Store from 30 October 2026. For a typical SME this is not the right answer: one more contract and one more cost, to keep a method Microsoft is dropping precisely because it protects poorly.
Why the SMS code is no longer protection
SMS did a real job. Ten years ago, a six-digit code behind a password discouraged the vast majority of automated attacks. The problem is that attacks have changed and SMS has not.
The most common scenario today is no longer an isolated stolen password but real-time phishing. Your colleague clicks a link, lands on a perfect copy of the Microsoft sign-in page and enters their credentials. Behind the scenes, the fake site immediately replays them against the real service, which sends an SMS. The page then politely asks for the code received, and relays it in turn. The attacker walks away with an open session. The code did exactly what it was asked to do, and it prevented nothing, because it never checks which site it is being typed into.
A passkey works differently. The key is cryptographically bound to Microsoft's official domain and stored in your phone, your computer or a physical security key. On a counterfeit page, it simply does not fire. No code to copy out, so nothing to intercept and nothing anyone can talk you out of over the phone. That is what makes it a phishing-resistant method, and it is the real reason behind Microsoft's decision.
What this will change in practice
The sensitive point is the blocking prompt. From the retirement date that applies to them, any user whose only available method is SMS or voice call will have to register a passkey during sign-in before they can continue. There is no postponing it. If the person is travelling or sitting at a client's office at that moment, the day starts badly.
The cases to look for are always the same: the colleague without a company smartphone, the one who refuses a corporate app on their private phone, the shared reception mailbox, and the break-glass administrator account nobody uses day to day.
The alternatives cover all these profiles: Microsoft Authenticator on mobile, Windows Hello for Business directly on Dell workstations, physical FIDO2 keys for accounts with no phone, certificates, and the Temporary Access Pass to rescue an enrolment. A fleet managed with Intune makes the exercise far easier: Windows Hello for Business is deployed by policy and registration happens at first start-up.
The three mistakes that derail the switch
The first is waiting until January 2027. An authentication migration is measured in weeks, because it depends on users, their phones and their travel. Started in October, it moves at the pace of your people. Started in January, it moves at the pace of lockouts.
The second is betting everything on personal phones. Some of your staff will refuse, and that is their right. Plan a physical FIDO2 key or Windows Hello for Business for them from the start, rather than discovering the problem mid-migration.
The third is forgetting the accounts that never sign in: the break-glass administrator account, the reception mailbox, the service account of a line-of-business application. Those are the ones you need most on the day something goes wrong, and they are exactly the ones nobody thinks to migrate.
If one of your staff can only validate a Microsoft 365 sign-in with an SMS code, they will be locked out on 1 February 2027, and the only way to avoid that is to give them another method before that date.
Your action plan in 6 steps
- Take inventory of the users still on SMS or voice calls in your tenant. Microsoft provides an analysis script that runs with a simple read-only role.
- Enable passkeys in the authentication methods policy, then run a gradual registration campaign rather than a single big-bang switch.
- Pick the method per profile: Authenticator for mobile users, Windows Hello for Business for desktops and laptops, physical FIDO2 keys for the workshop, the warehouse and accounts without a smartphone.
- Handle privileged accounts first: two methods per administrator and a backup key stored in the safe, before you touch standard accounts.
- Prepare recovery for a lost or replaced phone, Temporary Access Pass included, and say clearly who to call.
- Communicate before, not during: a simple email, a date and three lines of instructions will prevent half the support calls on the day.
SabiSys handles the switch for you
We do this work every day on the Microsoft 365 tenants we manage: inventory of the methods in place, enabling passkeys, deploying Windows Hello for Business through Intune policy across the Dell fleet, FIDO2 keys for shared workstations, and hands-on support for users who get stuck. For clients under contract, this is part of routine maintenance.
Not sure how many of your users still depend on SMS? Our free security check-up places you in three minutes, and a free, no-obligation audit reviews your Microsoft 365 environment and your security, at your offices, in one hour. Contact SabiSys, your IT partner in the Liege region.
Three minutes are enough to take stock.