Microsoft Ends SMS and Voice MFA Codes: Move Staff to Passkeys

What Microsoft announced and the exact dates

Microsoft announced the change on its security blog on 13 July 2026, and the details sit on the Microsoft Learn page Passkeys by default and retirement of Microsoft-provided SMS and voice authentication. Entra ID is the sign-in system behind Microsoft 365, so this affects every business that signs in to Outlook, Teams or SharePoint with a Microsoft work account.

After each retirement date, a user whose only MFA method is SMS or voice is forced to register a passkey before they can finish signing in. Microsoft is explicit that there is no opt-out for this enforcement. The change also covers self-service password reset, so SMS stops working there too.

Who in a small business is affected

You are affected if any user in your tenant still has SMS or voice as a sign-in method. In small Microsoft 365 setups that is common: staff who set up MFA years ago with a phone number, an owner who uses SMS because it was the first option offered, or a shared admin account tied to someone's mobile.

• Staff with only SMS or voice registered: they will be blocked at sign-in after 1 February 2027 until they register a passkey.
• Staff with SMS plus the Microsoft Authenticator app: they can keep signing in with Authenticator, but should still add a passkey; they may keep getting registration nudges while SMS stays enabled for them.
• Global Administrators: five more months, until 1 July 2027. Do not leave them until last; admin accounts are the ones attackers want most.
• External users and B2B guests: follow the July 2027 date. Internal guest accounts follow February.

Microsoft provides a PowerShell usage analyser on GitHub to list users still enabled for SMS or voice; it needs the Global Reader, Authentication Policy Administrator or Security Reader role. For a tenant of ten or fifteen people, the user list in the admin centre is often enough: open each user's authentication methods and note who has only a phone number.

Steps for a 10-person Microsoft 365 tenant

This is the order we suggest for a small office. It follows Microsoft's own sequence, simplified for a tenant without a dedicated IT team.

1. 1

   List who still uses SMS or voice

   Check each user's registered methods in the Microsoft Entra admin centre (Users, then Authentication methods) or run Microsoft's analyser script. Put the names in a simple list with their device type: iPhone, Android, Windows laptop, Mac.

2. 2

   Enable passkeys (FIDO2) as a method

   In the Entra admin centre, browse to Entra ID, Security, Authentication methods, Policies, select Passkey (FIDO2) and enable it for all users or a group. Microsoft's passkey set-up guide covers the passkey profiles and the option to allow synced passkeys.

3. 3

   Tell staff what is changing

   Send a short note: why SMS is going, the date, and that they will be asked to add a passkey on their phone or laptop. Microsoft publishes end-user templates at aka.ms/mfatemplates.

4. 4

   Turn on the registration campaign

   Under Authentication methods, Registration campaign, set the state to Microsoft Managed and target the group of SMS users. They will be prompted to set up a passkey the next time they complete MFA.

5. 5

   Register admins first, with two methods each

   Give every Global Administrator a passkey plus a second phishing-resistant method (for example a hardware security key kept in the office), and keep a separate break-glass account so a lost phone cannot lock you out of your own tenant.

6. 6

   Remove SMS and voice once everyone has moved

   When each user has a passkey, take them out of the SMS and voice policy so the nudges stop and nobody falls back to a text message code.

Staff without a smartphone, or who refuse to use their own

Passkeys do not have to live on a personal phone. Microsoft lists two kinds: synced passkeys stored in a platform credential manager such as iCloud Keychain or Google Password Manager, and device-bound passkeys stored in one place, such as the passkey in Microsoft Authenticator, a passkey on a Windows device, or a FIDO2 hardware security key.

Check which passkey types your passkey profile allows before buying keys, and register two keys per admin. If someone genuinely cannot use any of these, that is the case where a paid telephony provider might make sense; for most offices it does not.

Can you keep SMS codes? The telephony provider option

Yes, but you pay for it. Microsoft will no longer deliver the texts and calls itself. Organisations with a regulatory or operational need can contract a telephony provider through Microsoft Security Store, configurable from 30 October 2026. The initial providers named in Microsoft's documentation are Soprano and Telesign, with pricing set by the provider and region.

Microsoft also offers a temporary opt-out, set through Microsoft Graph, that delays the September 2026 auto-enablement and registration nudges until 1 February 2027. It only buys time. Enforcement on the retirement dates still applies to every tenant, and an opt-out does nothing to protect accounts from SIM swaps or phishing in the meantime.

For a small business, paying to keep the weakest sign-in method rarely makes sense. Our guide to phishing-resistant MFA explains why texts and voice calls are easy to intercept, and the CSA passwordless advisory guide covers passkeys for other accounts too.

Do it yourself or get help?

A tenant with under 15 users can usually do this in an afternoon if the admin is comfortable in the Entra admin centre. Our step-by-step MFA set-up guide covers the wider settings, such as security defaults and blocking legacy sign-in.

If you would rather have it done, our Microsoft 365 / Google Security Lockdown (S$590, up to 15 users) enforces MFA, cleans up admin roles, sets a break-glass account and blocks legacy sign-in. Our Password Manager Rollout (S$290) adds a shared vault so passwords and passkeys for other business tools are not stuck on one person's phone. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send your brief in writing and track progress on the order page.