Microsoft is changing how everyone signs in to Microsoft 365. From 1 September 2026, passkeys become the default sign-in method for eligible users, and text message and voice call verification codes provided by Microsoft will stop working from 1 February 2027.

• What it is: Passkeys are a more secure sign-in method that replace passwords and SMS codes with a fingerprint, face scan, or device PIN.
• Who is affected: Every Microsoft 365 business currently using Microsoft's own SMS or voice call codes for multi-factor authentication.
• The risk: Staff who rely only on text message codes will be prompted to register a passkey on the spot once the change lands, and could be locked out of their account if this happens without warning.
• What to do: Businesses that want to keep using text message codes will need to set up a separate telecom provider before February 2027. Otherwise, we recommend moving staff to passkeys or the Microsoft Authenticator app ahead of time.

We recommend reviewing how your staff currently sign in to Microsoft 365 well before September, so the move to passkeys happens on your terms rather than Microsoft's.

Source: Microsoft Learn