Microsoft Is Retiring SMS MFA: Move Your Business To Passkeys
Microsoft retires SMS and voice sign in codes from 1 February 2027. Passkeys are the replacement, and the change has already started.
Why Passwords Keep Failing
Passwords remain behind the majority of account compromises, not because people choose obviously bad ones, but because passwords can be phished, guessed, reused across multiple sites, or bought in bulk after an unrelated data breach somewhere else entirely. Multi factor authentication has closed much of that gap, but not all of it. SMS codes can be intercepted, and push notification approvals can be worn down through repeated prompts until someone approves one by mistake. Passkeys are designed to remove the weakness at its source, rather than adding another layer on top of a password that can still be attacked.
What a Passkey Actually Is
A passkey is built on public key cryptography instead of a shared secret. When a passkey is created, the device generates a public and private key pair. The private key never leaves the device, or stays within a trusted, encrypted sync such as Windows Hello, and only the public key is stored with Entra ID. Signing in proves possession of the private key without ever transmitting anything a fake website could capture or replay. That is what makes passkeys genuinely phishing resistant rather than simply harder to guess, there is no secret in transit for an attacker to steal in the first place.
Why Passkeys Help
Phishing Resistant
No secret is ever transmitted, so a fake login page has nothing worth capturing.
Faster to Use
A biometric or device PIN unlocks the key locally, no password to type or remember.
No Shared Secret
Nothing sits in a password database anywhere, waiting to be breached, reused or sprayed.
Phishing Resistance
From passwords and SMS codes to a phishing resistant passkey.
The Deadlines You Need to Know
Microsoft has now put firm dates against all of this, and the first one has already passed.
Since 1 September 2026, passkeys are the default sign in experience in Entra ID. Any user still enabled for SMS or voice has been automatically enabled for passkeys, and the next time they complete multi factor authentication they are nudged to register one. That prompt can still be snoozed, which is why plenty of businesses have not noticed the change yet.
The date that actually bites is 1 February 2027. From then, Microsoft provided SMS and voice are retired for every user except Global Administrators and external users, who follow a later date of 1 July 2027. Anyone affected whose only second factor is a text message or a phone call will be stopped at sign in and required to register a passkey before they can reach their account. Microsoft has been unusually blunt about this one, there is no opt out and it applies to every tenant.
If you have a genuine regulatory reason to keep SMS, Microsoft is opening a path to bring your own telecommunications provider through the Security Store. Details are published on 18 September 2026 and configuration opens on 30 October 2026. For most businesses that is an expensive workaround for a problem passkeys already solve.
Rolling Passkeys Out Across Your Business
Entra ID supports passkeys through the Microsoft Authenticator app, physical FIDO2 security keys, and Windows Hello for Business, giving most businesses a realistic mix of options for different roles and device types. A rollout starts with enabling passkey authentication methods inside your Authentication Methods policy, deciding which passkey types to allow, and setting a realistic timeline for moving people off older, weaker sign in methods. This is exactly the kind of change IT With You manages through our Identity and Access Management service. If your business is still relying mainly on passwords and SMS codes, passkeys are one of the more meaningful upgrades available right now.
Frequently Asked Questions
Synced passkeys live in a platform credential manager such as iCloud Keychain or Google Password Manager, and follow the user across their devices. Device bound passkeys stay on one device, whether that is Microsoft Authenticator, Windows Hello for Business or a FIDO2 hardware key. Synced is far easier to roll out and still a large improvement on SMS. Device bound gives you tighter control, because Entra ID can restrict which key types are allowed. Most businesses land on synced for general staff, and device bound for administrators and anyone handling sensitive data.
They do not need one. A FIDO2 hardware security key works on its own, and Windows Hello for Business turns a work laptop into the second factor using the fingerprint reader or face camera already built into it. This is one of the more common reasons a rollout stalls, and it is solvable for the cost of a key.
Where several people use the same device, a passkey tied to that device does not work well. FIDO2 hardware keys are usually the answer, and IT With You issues them for these users, because the key belongs to the person rather than the machine, and travels with them between shifts and workstations.
Every tenant should keep at least two break glass administrator accounts, and they need a phishing resistant method as well. FIDO2 hardware keys stored securely offsite are the standard approach. These accounts hold the Global Administrator role, so their SMS retirement date is 1 July 2027 rather than February, but they should not be relying on SMS at all. Microsoft recommends testing them at least every 90 days, not after you are locked out.
Struggling to roll out passkeys?
IT With You finds who is still on SMS or voice, plans the rollout around your team and their devices, and gets everyone onto a phishing resistant method well before the February 2027 deadline.