Microsoft Is Retiring Text-⁠Message Logins. Here Is Your Deadline.

If your business runs on Microsoft 365, there is a good chance some of your team still logs in by typing a password and then a six-⁠digit code from a text message. That method is going away, on a schedule Microsoft has already published.

This is not a vendor nudge or a best-⁠practice suggestion. It is a dated change to how sign-⁠in works, with an enforcement date attached — and most small businesses have not heard about it yet, because the announcement lives in an identity-administration document nobody outside IT reads.

The two dates that matter

September 1, 2026 — passkeys became the default. Since that date, anyone set up for text or phone-⁠call codes is automatically enabled for passkeys, and the next time they complete a sign-⁠in they get prompted to register one. It is a nudge, not a wall: people can skip it, and by default they can keep skipping it. Nothing breaks. But every one of your employees now sees an unfamiliar security prompt, and if nobody has told them what it is, your phone rings.

February 1, 2027 — Microsoft-⁠provided text and voice codes are retired for most users. After this date, anyone in scope whose only second factor is a text message or phone call is required to register a passkey during sign-⁠in before they can continue into their account. Microsoft describes this prompt as blocking, and states there is no opt-⁠out from it for users in scope of the February 1 retirement. That is everyone except Global Administrators (the top-⁠level admin accounts) and external users (accounts from outside your organization), whose date Microsoft moved to July 1, 2027.

Nobody is permanently locked out of anything. But “my login is demanding something I have never seen and I have a client on the phone” is a bad morning for the employee and a worse one for whoever supports them — multiplied by however many people were still on text codes.

Why Microsoft is doing it

Because text-⁠message codes were never actually strong, and attackers have gotten very good at collecting them. A convincing fake login page asks for the password and the code in the same breath, and relays both to the real site while the victim is still reading. SIM-⁠swap fraud moves the phone number itself. Neither attack requires sophistication anymore — the toolkits are rented.

A passkey removes the thing being stolen. Instead of a secret you type, your device proves who you are with a key it never hands over, unlocked by your fingerprint, face, or PIN. There is nothing to phish, because there is nothing to type. That is the whole reason insurers and auditors started asking specifically about phishing-⁠resistant authentication instead of just asking whether you have MFA.

Who this actually hits

Not everyone. If your people already sign in with Windows Hello, a passkey (including one stored in the Microsoft Authenticator app), or a security key, they are on a phishing-⁠resistant method and nothing changes for them. People who approve sign-⁠ins in the Authenticator app aren’t affected by the retirement either — though app approvals and app codes are not phishing-⁠resistant, which matters for the last step below.

The exposure is anyone still receiving codes by text or phone call. In most small businesses that is a specific, predictable group:

• The people who set up their account years ago and were never migrated when the Authenticator app arrived.
• Staff without company phones — floor, field, and shift workers who registered a personal mobile number because it was the only option offered.
• Executives and owners who opted out of installing a work app on a personal device and chose text codes instead. This group tends to be both the most exposed and the least patient about a surprise prompt.
• Shared and kiosk accounts pointed at one office phone line — the ones nobody remembers until they stop working.
• Anyone whose password reset depends on a text, since the retirement covers self-⁠service password reset too.

You do not have to guess who is on the list. Microsoft publishes a script that reports exactly which accounts in your tenant are still enabled for text or voice, and running it is the honest first step — the answer is usually higher than people expect and occasionally zero, which is a good morning either way.

The part most businesses will get wrong

The temptation is to wait until January 2027 and handle it then. That converts a manageable project into a support emergency, for three reasons.

First, the September nudge is already noisy. Since September 1 your whole team has been seeing prompts, and confused people call somebody. If that somebody has no answer prepared, you spend the autumn improvising.

Second, the hard cases take time to solve. The employee with no smartphone, the shared workstation, the executive who will not install anything — each has a good answer (a hardware security key, Windows Hello on the machine itself), but each answer needs to be chosen, bought, tested and taught. That is a calendar problem, not a technical one.

Third, doing it early is free and doing it late is not. Migrating to passkeys carries no extra license cost. The fallback for businesses that truly must keep text messages — configuring a telephony provider through the Microsoft Security Store — is an ongoing per-⁠message expense, paid to preserve the weakest method available.