Why is Microsoft ending text-message login codes — and how do you switch to a passkey before February 2027?

Microsoft-provided text-message and voice login codes retire February 1, 2027 for most users (July 1, 2027 for global administrators and external users), and passkeys became the Entra ID default on September 1, 2026. Here is why texted codes are being retired, and the five steps to switch to a passkey now.

Short answer: Microsoft is retiring the text-message and voice-call login codes it provides, because passkeys are safer — and the change is already under way. Passkeys became the default in Microsoft Entra ID on September 1, 2026 for people signing in with SMS or voice. Microsoft-provided SMS and voice authentication retires on February 1, 2027 for most users, and on July 1, 2027 for global administrators and external users.

Organisations that still need phone codes after that must bring their own provider through the Microsoft Security Store.Why it matters, in plain English: a texted code travels, and anything that travels can be taken — stolen through SIM-swap fraud, talked out of you by a convincing scammer, or intercepted on the way. A passkey works differently. Its private key never leaves your device, and it is tied to the real website, so a fake look-alike login page cannot use it: there is no code to hand over, even by accident.Switch now, step by step:1.

Sign in to your Microsoft account and open the security and sign-in options area.2. Add a passkey, creating it with your face, fingerprint or device PIN when prompted.3. Keep one backup method — an authenticator app or a hardware security key — so a lost phone does not lock you out.4.

Test it: sign in on a second device and confirm the passkey prompt appears and works.5. Do the same for family members who use Microsoft 365 for work or school, well before the February 2027 deadline.Pro tip: set up the passkey on your phone first — it usually takes about two minutes at sign-in, and your phone is the device you almost always have with you.Ad’s take: Texted codes felt safe because they felt familiar. A passkey feels odd for exactly one sign-in — then it just feels faster.