Passkeys Are Replacing the Phone Number. Microsoft's Deadline Is February 1.

Our view: the phone number is finished as a key to your business. Sign-in is moving to passkeys, credentials you unlock the way you unlock your phone and that only work on the site they were made for. Small offices that plan around passkeys now will meet the deadlines that follow with time to spare.

Microsoft has now set one for every office on Microsoft 365. On February 1, 2027, it stops sending text and voice-call sign-in codes for most work and school accounts, and anyone who still depends on one will have to register a passkey before they can sign in. We'd move every person in your office this fall, starting with whoever holds the admin accounts.

TL;DR

• Our view: the phone number is done as a sign-in key, and passkeys are what a small office should plan around now.
• Microsoft stops sending its own sign-in texts and calls for most work and school accounts on February 1, 2027, and for Global Administrators and external users on July 1, 2027.
• After those dates, anyone whose only check is a text or call must register a passkey to keep signing in, so we'd move everyone this fall, admins first.

What is Microsoft changing, and when?

Key fact: After February 1, 2027, anyone whose only sign-in check is a Microsoft text or call must register a passkey during sign-in before they can continue, and Microsoft's retirement guide says there's "no opt out" for that step.

Microsoft announced the change on July 13, and the retirement guide, last updated September 23, sets this schedule:

For now, people can skip the September prompt as often as they like. Microsoft's FAQ calls text and voice codes some of the most vulnerable methods available, and the July post cites AI-enabled phishing campaigns with click-through rates as high as 54%, against roughly 12% for traditional ones.

From October 30, a company can pay a telephony provider through Microsoft Security Store to keep sending codes. We wouldn't bother: Microsoft pitches it at regulated or operational needs, and it charges nothing extra for passkeys.

Who is affected?

Anyone who confirms work or school sign-ins by text or phone call. Every Microsoft 365 subscriber uses Microsoft Entra ID, so that's your staff, and the FAQ says password resets by text count too.

The July date covers only the Global Administrator role and external users, meaning guests who sign in with an outside account. Other admin roles and internal guest accounts follow February 1. Anyone who also has the Microsoft Authenticator app set up won't hit the blocking screen, though they may still see the prompt.

Personal Microsoft accounts are on a separate track. Microsoft's support site says it'll start phasing out text codes there too, without a date.

How do you find who still uses text codes?

If your plan includes Microsoft Entra ID P1, as Microsoft 365 Business Premium does, go to Entra ID > Authentication methods > Activity in the Microsoft Entra admin center. The Registration tab counts people by method, and clicking a method shows their names. The data can lag by up to 36 hours.

Without P1, go to Entra ID > Users, pick each person and open Authentication methods. Or ask your team to check Security info for a phone number.

Which passkey should each person use?

Our picks, all from options Microsoft documents:

• Most staff: a synced passkey on the phone they carry, saved in iCloud Keychain or Google Password Manager. It survives a lost or replaced phone. Microsoft recommends synced passkeys for most users and reports a 99% registration success rate among its personal-account users.
• Anyone who wants work kept out of their Apple or Google account: a passkey in Microsoft Authenticator on iOS 17 or Android 14 and later. It stays on that one phone, so a new phone means setting it up again.
• Every Windows PC: a passkey on Windows as the second method, unlocked with the PIN or fingerprint people already use. Microsoft recommends two methods per person.
• Admins: two FIDO2 security keys each, one carried and one locked away. Microsoft's deployment guide recommends security keys for admins.

Authenticator's push approvals aren't part of the retirement, which covers texts and calls. We'd still add a passkey, because Microsoft's own phishing-resistant standard leaves push approvals out.

Start now, while a text code can still confirm who someone is during setup. Once their passkeys work, delete their phone number from their sign-in methods (after checking they can still reset a password), because CISA notes a leftover text option gives attackers a weaker way in.

How do you avoid locking anyone out?

Microsoft's FAQ says nobody is locked out on the cutoff date; people get a setup screen they can't skip. Trouble starts when someone can't finish it.

So do the owner and other admins first, even though Global Administrators have until July. Microsoft also recommends two or more emergency access accounts: cloud-only Global Administrator accounts that sign in with a security key kept somewhere safe, tested at least every 90 days.

Turn on Temporary Access Pass before anyone needs it. It's a time-limited code an admin issues so someone who lost a phone can sign in and register a new passkey. Microsoft's docs say the admins who issue these passes can't issue one to themselves, one more reason the owner shouldn't be the only admin.

Then set one rule: passkeys get set up from the sign-in prompt or Security info, never from a link someone sends. In September, Microsoft researchers described attackers posing as the IT help desk who pressed employees to update passkey or MFA settings, then texted them links to fake sign-in pages.

What about staff without a company phone?

If someone won't put work sign-ins on a personal phone, don't push. Buy them a security key, an option Microsoft's guidance covers when it mentions "distributing security keys where users won't use apps." It registers through Security info like any other passkey.

On shared PCs, Microsoft says to use a passkey on Windows registered for each account, or a portable option like a security key. Keys also cover older phones, which Microsoft says may need external authenticators.

Where is this headed?

Our predictions, with the evidence behind each:

• By the end of 2027, personal Microsoft accounts stop getting sign-in texts too. Microsoft has already said it'll phase them out there, calling SMS sign-in "a leading source of fraud," and both of its work-account cutoffs land in 2027.
• By the end of 2028, your bank will be steering you off text codes. Singapore's major retail banks started dropping one-time passwords for logins by digital-token users in 2024, citing phishing. In the US, NIST's identity guidelines classify phone codes as restricted, and CISA's guidance says, "Do not use SMS as a second factor for authentication."
• Passwords are next. Microsoft made new personal accounts "passwordless by default" in May 2025 and has said it wants to eventually remove password support altogether. Our bet: new Microsoft 365 work accounts get the same default by the end of 2028.
• The first week of February 2027 will be expensive for offices that waited. Expect people stuck at a setup screen they can't dismiss, some on phones too old to finish it. Offices that move this fall won't notice the date.

If you'd like a second set of eyes on your office's plan, get in touch.