Microsoft is killing SMS logins for business accounts. Passkeys take over in September 2026.

Key points

• Microsoft will make passkeys the default sign-in method for Entra ID, its enterprise login service, starting September 2026.
• SMS and voice-call authentication will be retired across all business tenants on February 1, 2027.
• Anyone currently using SMS or voice codes will be prompted to register a passkey the next time they log in.
• Microsoft Threat Intelligence reports AI-generated phishing emails now achieve a 54% click-through rate, versus 12% for older campaigns.
• Companies that still need phone-based codes after the deadline must bring their own telecom provider through the Microsoft Security Store.

Microsoft is finally pulling the plug on text-message logins for its business customers.

The company announced that passkeys, a login method that uses your phone or laptop's built-in security chip instead of a password, will become the default way to sign into Entra ID from September 2026. Entra ID is the system most large employers use to control who gets into their email, work files and internal apps. If you've ever logged into a work account with a Microsoft prompt, you've used it.

Anyone still receiving one-time codes by text or automated phone call will be nudged onto passkeys automatically. The next time they do their usual multi-factor check, meaning the second step after typing a password, they'll be asked to set one up.

Then, on February 1, 2027, Microsoft turns the old system off.

After that date, Microsoft will no longer send SMS or voice codes on behalf of its business customers. Companies that genuinely still need phone-based codes will have to hire a third-party telecom company through the Microsoft Security Store and wire it in themselves. Some regulated industries will likely fall into that category.

People who already use passkeys, Windows Hello for Business, physical FIDO2 security keys (a USB stick you tap to log in), or smart cards won't see any change. Those methods already resist phishing, where criminals send fake login pages to steal credentials, so Microsoft is leaving them alone.

Why is Microsoft doing this now?

Because text-message codes have become one of the easiest things for criminals to steal. Microsoft's own threat researchers report that phishing emails written with AI help now reach a 54% click-through rate, compared with about 12% for older campaigns. Once a victim clicks, a fake login page can grab both the password and the six-digit code in real time and hand them to the attacker.

Passkeys sidestep that trick entirely. There's no code to type in and forward to a criminal. The login is bound to the specific website and the specific device, so a fake page can't complete the handshake.

As BleepingComputer noted in its coverage, this shift lands during a rough stretch for Microsoft's business logins. The extortion crew known as ShinyHunters has spent much of the past year harvesting Entra single sign-on credentials and using them to raid the software-as-a-service apps sitting behind them. We reported on the tools criminals are using to run those attacks in our 14 July story on the Forg365 phishing kit. Stolen passwords plus a phishable text code is exactly the combination those kits are built for.

Worth keeping in mind: as we found when covering the shift in attacker tactics on 8 July, passkeys winning at the login step doesn't end the fight. Attackers are already moving pressure to password resets and help desks.

What should IT teams do before the deadline?

Find out who is still on SMS or voice, then move them.

Microsoft has published a PowerShell script, the Entra SMS/Voice Policy Scanner, that admins with read-only roles can run to list affected users. The recommended path is to roll out passkeys, Windows Hello for Business or physical security keys well before the February 2027 cutoff. Leave it late and staff will find themselves locked out on a Monday morning.

For ordinary workers, the change should be mostly invisible. Expect a prompt from your IT department some time in 2026 asking you to register your face or fingerprint as your new sign-in. One-time setup, one less password to forget.