Microsoft 365's Text-Message Login Codes Are on a Deadline
Microsoft made passkeys the default on September 1, 2026, and its built-in text and voice codes end February 1, 2027, for most users.
If your staff still approve sign-ins by text message, that habit has an end date, and waiting will turn a simple setup into a locked-out morning.
What to do this week: Have each employee register a passkey on the phone or computer they already use, then keep one backup method.
Microsoft's own guidance says passkeys became the default for Microsoft Entra ID users enabled for text (SMS) or voice on September 1, 2026. That is the system many small offices know as their Microsoft 365 sign-in.
The calendar is the story
Microsoft Learn, accessed October 17, 2026, says Microsoft-provided SMS and voice delivery retires February 1, 2027, for most users, and July 1, 2027, for global administrators and external users. After that, users whose only extra method was SMS or voice must register a passkey before they can sign in, with no opt-out. People who already sign in with a passkey (including one stored in the Microsoft Authenticator app), Windows Hello for Business, or another phishing-resistant method can keep using it, Microsoft says, though they may still be prompted to register a passkey.
Our calculation: from October 17, 2026, to February 1, 2027, is 107 days. That sounds roomy until one person's phone number, handset, or job changes in between — then it becomes a help-desk ticket on the busiest day.
Help Net Security reported the same overhaul on July 14, 2026, describing passkeys as the default starting September 1. BleepingComputer independently reported the Entra ID change the same week.
A passkey is a key that stays with you
Microsoft explains that a passkey uses cryptographic keys rather than a shared secret, and can sync through a credential manager or stay bound to one device. In plain terms, there is no six-digit code to read to a caller or type into a look-alike page.
Think of it like the difference between a house key and a spoken password through the door. A password can be overheard and reused; the key has to be present. Your fingerprint or face scan, Google noted on October 8, 2026, stays on your device when you use a passkey for a Google Account.
Google's October 8, 2026, guide gives consumers the same move in miniature: create a passkey and sign in with the fingerprint, face, or device PIN you already use. Two rivals are pushing the same direction, which is why this is not one vendor's quirk.
The other side
Microsoft says a business with a real operational or regulatory need for SMS or voice can buy delivery through a telephony provider in the Microsoft Security Store, starting October 30, 2026, per its timeline. That keeps the weaker method available at a cost; it does not make it phishing-proof.
The tradeoff is honest: a lost device without a backup method can lock a person out. Register the passkey and a backup before you need either one.
What this means for Southwest Michigan
A small office in Hamilton or Hopkins rarely has a spare administrator. If the one person who approves payroll is forced to register on February 1, 2027, before signing in, the lesson arrives at the worst time. Doing it on a quiet afternoon costs minutes.
Ask who still uses text or voice, register a passkey for each person, and write down the backup path where the office manager can find it — not in a shared password list.
One thing to do this week: register your own passkey first, then schedule the rest of the office before the February rush.
Disclosure: Cybercave Technologies, LLC provides IT services to small businesses. No company named in this article paid for, sponsored, or reviewed it.
This article is general information, not advice for your specific situation.
Sources (accessed October 17, 2026)
- Primary — Microsoft Learn, "Passkeys by default and retirement of Microsoft-provided SMS and voice authentication," accessed October 17, 2026 (dates above as of that page): https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement
- Primary — Microsoft Security Blog, July 13, 2026, "Passkeys are the default authentication method in Entra ID": https://www.microsoft.com/en-us/security/blog/2026/07/13/microsoft-entra-id-security-updates-passkeys-are-the-default-authentication-method-in-entra-id/
- Help Net Security, July 14, 2026, "Microsoft Entra ID authentication overhaul to start in September 2026": https://www.helpnetsecurity.com/2026/07/14/microsoft-entra-passkey-authentication/
- BleepingComputer, July 2026, "Microsoft Entra ID gets passkeys default authentication starting September": https://www.bleepingcomputer.com/news/microsoft/microsoft-entra-id-gets-passkeys-default-authentication-starting-september/
- Primary (separate vendor) — Google, October 8, 2026, "How to set up a Google Account passkey": https://blog.google/innovation-and-ai/technology/safety-security/how-to-set-up-passkey/
Independence note: Microsoft sources (1–2) count as one vendor source; Help Net Security (3) and BleepingComputer (4) are independent trade outlets; Google (5) is a separate primary. At least 3 independent sources. No X source counted.
Human-scale math: February 1, 2027 minus October 17, 2026 = 107 days — our calculation, shown from the sourced dates.
General information only. Corrections: support@cybercavetech.com