Applies to all plans

Microsoft is retiring its own text message (SMS) and phone call verification for Microsoft 365 sign-ins. That’s the “we’ve sent a code to your phone” step many people still use for multi-factor authentication.

When

From 1 February 2027, with the rollout expected to finish in early February. Global administrators and external guests follow from 1 July 2027.

Why

Text codes can be intercepted through phishing and “SIM swap” scams, where an attacker takes over someone’s mobile number. Microsoft recommends passkeys or the Microsoft Authenticator app instead.

Who’s affected

• People who only have SMS or phone call set up. They risk being blocked from signing in once the change reaches your organisation. People who already use the Authenticator app or a passkey won’t notice anything.
• Password resets. About 50 days after the change reaches your organisation, text and phone codes will also stop working for self-service password reset. This catches out people who sign in with Authenticator but still rely on a text code to reset a forgotten password. Microsoft notes that a passkey alone doesn’t automatically count as a password-reset method.

What to do

• Find out who in your organisation still relies on SMS or phone calls. Microsoft has started emailing some organisations directly when it detects these users.
• Help those people set up the Authenticator app or a passkey well before February, not on the morning they get locked out.
• Check everyone has a valid way to reset their password.

Business Premium: this is easier to manage. Conditional Access lets us require stronger sign-in methods and stop new SMS registrations, so nobody slips back.
Business Standard and Basic: these plans don’t include Conditional Access, so the move relies on your organisation’s MFA settings and a bit more hands-on help getting people set up.

Organisations that must keep text codes can do so through their own telecom provider, but for most people moving to Authenticator or passkeys is the better option.

Tranquil IT Managed IT clients: we’ll check which of your users are affected and contact you before Christmas with a plan.

Questions, or want a hand with this? Just get in touch.

Source: Microsoft 365 Message Center (MC1528000, MC1536049, MC1540327) via mc.merill.net. Message Center posts vary by organisation; check your own admin centre for details specific to you.