Microsoft Is Retiring Text-Message Login Codes

If you’ve ever gotten a text with a six-digit code to log into Outlook, Teams, or SharePoint, that’s the exact login method Microsoft is walking away from. It’s not disappearing overnight, and nothing breaks today — but the timeline is real, it’s already started, and the businesses that plan for it now will barely notice the switch.

This isn’t a Microsoft-specific quirk, either. It’s part of a much bigger shift away from anything that can be phished, guessed, or intercepted, toward login methods that simply can’t be handed over by accident. Here’s the plain-English version of what’s happening and what it means for your team.

Data Breaches w/ Compromised Credentials

So, What Exactly is Changing?

In plain terms: Microsoft is phasing out its free, built-in text-message and phone-call login codes and replacing them with passkeys — a login method built directly into your phone, laptop, or a small security key, instead of a code sent to you over text.

A passkey can’t be intercepted, forwarded, or tricked out of someone the way a text code can. There’s no code to steal in the first place — your device itself proves it’s you.

Here’s the rollout, broken into four dates:

Date	What Happens
Aug 1, 2026	Microsoft shares pricing and details for third-party providers businesses can use if they still need text/call codes after the cutoff.
Sept 1, 2026	Passkey prompts begin. Users still on text/call MFA start seeing sign-in prompts to register a passkey — these can be skipped for now.
Oct 30, 2026	Backup phone-provider options open up in the Microsoft Security Store, for businesses that decide they still need SMS or voice codes.
Jan 28, 2027	Microsoft's free text and call codes stop working entirely. From this point on, only a paid third-party provider can deliver them.

Why Is Microsoft Doing This Now?

Text and call codes have been the default MFA method for years, mostly because everyone has a phone and it always worked. But that’s exactly the weakness: a text message can be intercepted, a phone call can be spoofed, and a convincing enough phishing message can talk someone into reading their code out loud without realizing it. Microsoft has pointed to AI-driven phishing as a major factor here — automated attacks that are faster and more convincing than what SMS-based codes were ever designed to withstand.

Text & Call Codes

✕

Can be intercepted or redirected

✕

Can be talked out of someone via a convincing phone call or text

✕

Relies on cell signal — fails while traveling or in dead zones

✕

Increasingly targeted by AI-generated phishing

Passkeys

✓

Nothing is sent anywhere for an attacker to intercept

✓

Can't be phished — there's no code to trick someone into sharing

✓

Works with Face ID, fingerprint, or device PIN already on most phones

✓

Free — included in every Microsoft 365 and Entra plan

What Are Your Options?

Most of your team will land on the first option below without any real change to their day. A small handful of people — those on shared computers, without a work phone, or in tightly regulated roles — may need one of the others.

1

Microsoft Authenticator App

Free, and already on most people's phones. This is the default option for the majority of your team.

2

Physical Security Key

A small USB or NFC key, best for shared/kiosk computers, regulated roles, or anyone without a work phone.

3

Windows Hello

Face or fingerprint sign-in built into a company-managed laptop — no phone needed at all.

Note: once set up, it works on that one device without needing IT help again. But signing into anything else, like a new laptop or another employee's machine, will need IT's help each time.

For budgeting purposes, if a security key is needed:

1 user – $75
5 users – $375
10 users – $750
25 users – $1,875

Worth knowing: across industry data, passkey sign-ins succeed roughly 93% of the time on the first try, compared to about 63% for traditional passwords — fewer lockouts, fewer help desk tickets, less friction for your team.

What Should You Do Right Now?

Nothing breaks today, and nothing will for months. But a little planning now avoids a scramble later:

Let your team know passkey prompts are coming, so they’re not caught off guard starting September
Decide if anyone still needs SMS or voice codes past January 2027 — that requires setting up a paid backup provider ahead of time
Identify anyone on shared/kiosk computers or without a work phone, since they’ll likely need a physical security key
Review your BYOD policy if some employees will need to install Microsoft Authenticator on a personal device

How SBT Is Helping

SBT is actively monitoring Microsoft’s rollout and will reach out to clients directly as next steps become clearer. In the meantime, if you want to know exactly how this affects your specific setup — or whether your business needs a security key, a BYOD policy update, or nothing at all — we’re already on it.