Microsoft is phasing out one of the most common ways employees sign into email, Teams, and business applications, and the deadline is already set.
Many organizations still rely on text message verification when employees sign into Microsoft 365 and Microsoft Entra ID. By February 2027, that method is going away. At the same time, Microsoft is moving everyone toward a new standard: passwordless authentication using passkeys.
On paper, this looks like a simple security setting change. In practice, it touches something much more critical: how every employee accesses your business systems, every day.
If this transition isn't planned properly, the impact shows up quickly:
This is why leading organizations are getting ahead of it now, not waiting for the deadline.
The challenge isn't the technology. It's your workforce.
Most organizations have a mix of users who:
Today, SMS-based sign-in fills that gap. When it goes away, those users don't automatically have an alternative. That's where organizations get caught off guard.
There are two key shifts happening across Microsoft 365 and Microsoft Entra ID:
Microsoft isn't just replacing one method with another, they're changing the model. The expectation going forward is simple: sign-in should be secure, seamless, and not dependent on phone-based codes.
September 2026 Passwordless sign-in (passkeys) becomes the default. Users who rely on text or phone codes will start being prompted to register a new sign-in method.
October 2026 Organizations can configure a third-party telecom provider if they need to continue using SMS or voice authentication temporarily.
February 2027 Microsoft-provided SMS and voice authentication are fully retired. Text messages and phone calls will no longer work as sign-in methods.
After February 2027 Users who haven't transitioned will be forced to adopt passkeys at sign-in. There is no opt-out.
At a high level, you'll need to answer one question: how will your employees sign in after SMS is gone?
For most organizations, that leads to a combination of:
The right mix depends on how your workforce is structured, but the important part is making a decision early.
There will be a natural temptation to say: "Can we just keep using text codes for now?"
Short term, sure. But that path:
In other words, it delays the problem. It doesn't solve it.
The organizations that handle this well are doing three things:
Our focus is simple: make this a non-event for your users. That means:
This change is coming on a fixed timeline. The only variable is how it impacts your organization.
If you're unsure where your users currently rely on SMS or phone-based sign-in, that's the place to start. A short review is usually enough to understand where the exposure is, what your options are, and how to move forward without disruption.