Microsoft is retiring SMS and voice sign-in codes from 1 February, so the text message that lets you in has an end date
By Brett Gavaghan, Founder of Adaptd ·
Microsoft has told organisations to prepare staff who sign in with only SMS or voice codes. From 1 February 2027, Microsoft-provided SMS and voice verification stops for most users.
The short version
- Microsoft is retiring its built-in SMS and voice codes for multi-factor sign-in to Microsoft 365 and Entra ID.
- Most users lose them from 1 February 2027; Global Administrators and external users follow on 1 July 2027.
- Move staff to Microsoft Authenticator or passkeys before February so nobody gets locked out.
The six-digit text message has been the front door key for a lot of small businesses. Microsoft is changing the locks, and it has started sending reminders.
What is Microsoft changing?
Microsoft is retiring the SMS and voice codes it sends for multi-factor sign-in to Microsoft 365 and other Microsoft Entra ID accounts. Microsoft says SMS and voice are no longer positioned as secure methods, and passkeys became the default sign-in experience on 1 September 2026.
On 5 November Microsoft posted a message centre notice, MC1540327, telling organisations to prepare users who have only SMS or voice registered. Those users may be blocked from signing in on browsers or devices that don't support passkeys.
Who is affected, and when?
Most users are affected from 1 February 2027, when Microsoft-provided SMS and voice codes stop for everyone except Global Administrators and external users. Those two groups follow on 1 July 2027.
Microsoft calls these phased rollout start dates and can't say exactly when each organisation will be hit. Users with only SMS or voice will have to register a passkey during sign-in, and there's no opt out. Organisations that must keep text codes can pay for a third-party telephony provider instead.
What should your business do about it?
Your business should move every Microsoft 365 user off SMS and voice codes before 1 February 2027.
My advice: whoever looks after your Microsoft 365 should list who still relies on text codes, then help each person set up Microsoft Authenticator or a passkey. Microsoft notes that installing the app isn't enough, so check each person actually finishes the setup. Small business? This applies to you too, and for a small team it's a short job. Do the boss and the bookkeeper first, since they're the ones you can't afford to lock out at month end.
Better to sort it in November than to find out in February while someone waits for a text that never comes.
Sources
Wondering what this means for your business?
That's exactly what the discovery call is for.