Microsoft 365 Is Ending SMS and Voice MFA: How Small Businesses Switch to Passkeys Before February 1, 2027

Start here: what Microsoft has actually confirmed

Microsoft's own Learn documentation says that on February 1, 2027, Microsoft-provided SMS and voice call authentication is retired in Microsoft Entra ID for all users except Global Administrators and external users, whose date is July 1, 2027. After the date, anyone in scope whose only MFA method is a text message or a phone call will be forced to register a passkey at sign-in before they can continue. If your Microsoft 365 staff receive their login codes by text, this affects you.

We want to be careful here, because this topic is full of half-truths. Several reseller blogs quote the February 1, 2027 date, so we checked it against Microsoft's primary documents: the Microsoft Learn article titled "Passkeys by default and retirement of Microsoft-provided SMS and voice authentication" (last updated September 23, 2026 on the copy we opened) and its companion FAQ. Both state the dates above in plain words. So the February 1 date is confirmed by Microsoft itself, not just by reseller blogs.

The second Microsoft source people mix in is Message Center item MC1450133. It describes a different change: users will be able to register a passkey as their first MFA method, without first setting up SMS or voice. That item says "No action is required for this change," which is true for that specific feature. It does not mean you can ignore the SMS retirement. This guide keeps the two clearly apart.

Who is affected: owners, admins, staff and guests

This change lives in Microsoft Entra ID, the sign-in system behind every Microsoft 365 business tenant (Business Basic, Standard, Premium, and the Enterprise plans). You do not have to be a large company with an "Entra subscription." If you pay for Microsoft 365 for work, you already have an Entra tenant.

The nuance that surprises owners: scope is decided by policy, not by habit. A staff member who taps an Authenticator notification every morning can still be nudged toward a passkey if SMS or voice remains switched on for them in your authentication methods policy. Microsoft's Q&A guidance, as summarized in the sources we read, says users who have another available method such as Authenticator or a code app are not the group hit by the blocking prompt. They can keep using push or codes for ordinary MFA. They just do not meet a policy that demands a phishing-resistant method.

The admin side matters even more for a business with no IT department. Many small tenants have one Global Administrator, usually the owner, and that person often signs in with a text message code. Microsoft gives Global Administrators until July 1, 2027, which is tempting to treat as "later." Do not. The owner account is the single most valuable target in the company, and moving it first is the best use of 15 minutes this month.

The timeline: September 2026 to July 2027

Two Microsoft items overlap on the calendar, which is why the web is confusing. Here they are side by side.

A small honesty note: the Message Center text we read prints the phase 2 start as "early January 2026," which is clearly a typo for 2027 given that phase 1 only starts in November 2026. We report the dates as Microsoft's schedule implies them and tell you to confirm in your own admin center, because the community archive of that item shows an update dated October 26, 2026, so Message Center dates can change.

Why Microsoft is doing this

Microsoft's FAQ is blunt: SMS and voice are described as among the most vulnerable authentication methods available today, with significantly weaker protection against phishing and account takeover than passkeys. That matches what we see in the field. A text message code can be stolen by a fake login page that asks for it and relays it in real time. A SIM swap, where an attacker convinces a carrier to move your number, hands over every code. A passkey does not work that way: it is a cryptographic key tied to a real device or credential manager and to the real website, so a look-alike page gets nothing to steal.

If you want the plain-language explanation of how passkeys work and why they beat passwords, we already wrote it: Passkeys explained: passwordless login for business. For the bigger picture of why a second factor matters at all, read the MFA guide for business owners. In French, the equivalent is the guide MFA pour PME. This page stays focused on one question: what do you do before the retirement date?

Two changes that look like one

Owners keep asking whether they have "one deadline or two." There are two separate Microsoft changes, and they work together.

1. The retirement (Microsoft Learn). Microsoft stops delivering SMS and voice codes. This is the one with a hard date and a blocking prompt.
2. Passkey as first method (MC1450133). Users who are not yet registered for any MFA can go straight to a passkey, and users enabled for passkeys are prompted to register one by default during registration experiences triggered by MFA enforcement or Conditional Access authentication strengths. This one is a convenience and says "no action required."

The practical effect of both: the easiest path through a Microsoft sign-in screen will increasingly be a passkey, and the text message option will disappear unless you pay a third-party provider. Microsoft's own advice for the Message Center item is to review Conditional Access policies about security information registration, consider requiring MFA to register security info, and update your onboarding instructions to say that eligible users may be prompted for a passkey by default.

How to check which methods your tenant allows

You need to know three things before changing anything: which methods are switched on, who actually uses SMS or voice, and whether your tenant still relies on the old per-user MFA settings. You must sign in with a suitable admin role (for example Authentication Policy Administrator, Security Reader or Global Reader to read, and a policy role to change).

Step 1: read the authentication methods policy

1. Go to the Microsoft Entra admin center (entra.microsoft.com) and sign in as an administrator.
2. Open Entra ID, then Authentication methods, then Policies.
3. Look at the rows for SMS, Voice call, Microsoft Authenticator and Passkey (FIDO2). Note whether each is enabled and who it targets (All users or specific groups).

Step 2: see who registered what

1. In the same area, open Activity, then Registration (the authentication methods activity report).
2. Read the counts for mobile phone, Microsoft Authenticator, FIDO2, software OATH tokens and Windows Hello for Business.
3. Anyone listed under phone only is your priority list.

Microsoft also publishes a PowerShell usage analyzer for finding SMS and voice users (it needs a Global Reader, Authentication Policy Administrator or Security Reader role). For a tenant of 5 to 25 people, the admin center screens above are faster than running a script.

Step 3: check the legacy settings too

Microsoft says the September 1 auto-enablement applies to users enabled for SMS or voice either in the authentication methods policy or in legacy MFA settings. If your tenant was created years ago, it may still have per-user MFA turned on in the older multifactor settings page. Open that legacy page as well and note who is enabled. Do not switch anything off yet.

Step 4: note your baseline protection

Ask which protection your tenant runs today: Security Defaults, Conditional Access policies (Premium licences), or per-user MFA. Security Defaults is the free baseline Microsoft turns on for many small tenants. Message Center item MC1450133 says Security Defaults registration prompts will adopt the passkey-first experience in January to February 2027, so a small tenant on Security Defaults will see the change without configuring anything.

Write the result on a sheet: name, role, current method, phone type, and whether the person has a work-issued phone. That sheet is the backbone of everything below.

Your replacement options compared

Microsoft recommends passkeys as the primary path, but a five-person business has real constraints: personal phones, old phones, shared workstations. Here is how the options compare.

Our default recommendation for a small business with no IT staff: Authenticator on every staff phone first, passkeys second, a pair of FIDO2 keys for the owner and any shared account. Each step removes one weakness without forcing a single big change on a Monday morning.

Step-by-step: move your tenant off SMS and voice

This is the 20-minute core walkthrough for an owner or office manager. We split it into the admin part (once) and the staff part (per person).

Part A: the admin does this once (about 15 minutes)

1. Protect your own admin access first. Make sure you have at least two ways in and a second admin or a documented break-glass account. Do this before you tighten anything.
2. Enable passkeys in the policy. In the Entra admin center, go to Authentication methods, Policies, then Passkey (FIDO2). Set it to Enabled and target all users or a pilot group. Microsoft says passkeys (FIDO2) are supported in all Entra ID editions, with no extra licence required. In the passkey profile, allow the types you plan to use. If you plan to use the passkey inside Microsoft Authenticator, enable that attestation option in the profile as the Microsoft Learn Authenticator-passkey article describes.
3. Enable Microsoft Authenticator. Same page, row Microsoft Authenticator, set to Enabled for the same group. This is your stepping stone for staff who are not ready for passkeys.
4. Set up a registration campaign. Under Authentication methods, open Registration campaign. Choose the method to nudge toward (passkey or Authenticator, one at a time), include your group, and choose how many times users can snooze. Microsoft notes the default for the automatic September 1 campaign is unlimited snoozes, which means nobody is forced until February 1. For a small team, set a short snooze limit so the nudge turns into action in a few weeks.
5. Do not switch SMS and voice off yet. Only remove SMS from a person's policy scope after that person has registered and tested the replacement. Microsoft's own FAQ advises exactly that, to prevent further nudges.
6. Tell people. Use the plain-language message in the rollout section below. Microsoft publishes end-user communication templates (aka.ms/mfatemplates) if you prefer the official wording.

Part B: each person registers (about 5 minutes)

There are three common paths. Pick the one that fits the person.

Path 1: passkey in Microsoft Authenticator (recommended for most phones)

1. Install Microsoft Authenticator from the official App Store or Google Play listing.
2. Open the Authenticator app and add the work account, or sign in at mysignins.microsoft.com/security-info from a laptop.
3. Choose Add sign-in method, then Passkey in Microsoft Authenticator (the name may vary slightly by tenant and app version).
4. Follow the prompts, confirm with face, fingerprint or phone PIN, and name the passkey after the phone, for example "Alex iPhone."
5. Sign out and back in to test, using the new passkey.

Microsoft's guidance says Authenticator passkeys are device-bound (the key stays on that device and does not sync), and the minimum versions are iOS 17 and Android 14. On Android, the device needs secure hardware (a secure element or trusted execution environment), or registration fails. If a phone is older, Path 3 or Path 2 is a better fit.

Path 2: synced passkey (iCloud Keychain or Google Password Manager)

1. On iPhone, open Settings, General, AutoFill & Passwords, and set "Set Up Codes In" to Passwords. On Android, open Settings, Security and privacy, More security settings, Passwords, passkeys and autofill, and pick a provider. (These are the prerequisites on Microsoft Learn.)
2. Open a browser and sign in at mysignins.microsoft.com/security-info, completing MFA.
3. Tap Add sign-in method, then Passkey, then Next.
4. Confirm with biometrics, name the passkey, tap Done, and check that it appears in Security info.

The advantage: the passkey follows the person to their other devices through the platform account. The risk to manage: if that personal Apple or Google account is lost or shared, so is the passkey. For regular staff this is acceptable. For the owner and admins, prefer a device-bound or hardware key.

Path 3: Windows Hello or a FIDO2 security key

1. On a Windows 11 work laptop with a fingerprint reader or camera, set up Windows Hello in Settings, Accounts, Sign-in options.
2. For a security key, plug it in or tap it by NFC, open Security info, choose Add sign-in method, then Security key, and follow the prompts to set a PIN and touch the key.
3. Register a second key and store it separately. One key is a single point of failure.

Windows Hello for Business and macOS Platform SSO are part of Microsoft's phase 2 registration-flow change, so what you see on screen may differ depending on when your tenant receives the update.

Test before you remove anything

After each person registers, run this three-point test: sign out completely, sign in on a private browser window with the new method, and confirm Outlook and Teams still open on the phone. Only then remove SMS or voice from that person's scope. If any step fails, leave SMS enabled for that person and fix the registration first.

Beware the fake version of this process. Attackers send emails that imitate "register your passkey" notices. A real registration happens from your own known bookmarks or from mysignins.microsoft.com, never from a link in an unexpected email. We cover the red flags in fake passkey prompts and Microsoft 365 phishing: what to check.

A rollout plan for a small business (6 weeks)

You have until February 1, 2027 for most staff, which at the time of writing is roughly twelve weeks. The Christmas period sits in the middle, so we plan to be finished with the bulk before the holidays. Here is a schedule that works for 5 to 30 people.

A message you can copy to your staff

Keep the message short and put a real date and person in it. Microsoft's own guidance says coordinated communication is the biggest predictor of a smooth passkey rollout.

Lockout recovery: what to do when someone is locked out

This is the part that breaks first in small companies. Moving to passkeys is easy while everyone still has their old phone. It becomes painful when someone loses a phone, buys a new one, or leaves the company. Plan recovery before you need it.

Prevent lockouts

• Two methods per person. Every employee should end with at least two: for example Authenticator on the phone plus Windows Hello on the laptop.
• Two methods for the owner, plus a spare key. The owner registers a passkey in Authenticator and two FIDO2 keys, one in a safe or safety deposit box.
• A second admin. Never leave a tenant with only one Global Administrator who has one phone. Add a trusted second admin, even if that person is an outside IT provider.
• Break-glass account. A cloud-only emergency admin account with a long random password stored offline, excluded from policies that could lock it out, and monitored for sign-ins. Microsoft documents this pattern in its emergency access guidance.

Recover a locked-out regular user

1. An administrator verifies the person's identity outside email, for example by a video call or in person. Do not accept a reset request purely by text or email, because attackers use that exact trick.
2. In the Entra admin center, open the user, then Authentication methods, and delete the lost device's methods. Use Require re-register multifactor authentication if that option is shown.
3. Administrators can also issue a time-limited credential to bootstrap a new registration. Microsoft documents the Temporary Access Pass for this: a time-limited passcode that lets a user register new passkeys. We cover it below.
4. The user signs in with the temporary credential, registers a new passkey and a second method, and the admin confirms in the registration report.

Temporary Access Pass in one paragraph

A Temporary Access Pass is an admin-issued, time-limited passcode that proves identity so the user can set up a passkey without an old method. It has to be allowed in your authentication methods policy first. Use a short lifetime (an hour or less) and one-time use for a single setup. If you are not sure it is enabled in your tenant, check the Temporary Access Pass row in the same Policies screen before the day you need it.

Lost-phone checklist

• Remote-wipe or sign out the lost device (Intune or the user's phone account), and revoke sessions in Entra.
• Remove the lost phone's passkey and Authenticator registration from the user's authentication methods.
• Issue a Temporary Access Pass, register on the new phone, and add a second method.
• Change the password if there is any chance the phone was accessed while unlocked.

For personal-account problems with Authenticator itself, our guide on recovering access when you lose your authenticator app covers the consumer side in more detail.

Shared accounts, shared mailboxes and kiosk PCs

Passkeys are tied to a person. That makes them excellent for individuals and awkward for the three shared patterns common in small businesses.

Shared mailboxes (info@, billing@)

A shared mailbox does not need its own sign-in at all. In Microsoft 365, shared mailboxes are normally accessed by staff who have their own accounts, and the shared mailbox account is typically sign-in blocked. If your "shared" address is actually a normal licensed user that three people log into with one password and one phone, that is the pattern to retire. Convert it to a shared mailbox and give each person delegated access. Check licensing and the current conversion steps in the Microsoft 365 admin center before you do this, since conversion has rules, such as mailbox size and licence handling.

One login used by several people

Sharing a work login makes it impossible to know who did what and breaks the idea of a personal passkey. The fix is a named account for each person. Licensing a new seat costs money, so do the math: a seat is usually cheaper than the cost of one compromised mailbox.

Reception desk, shop floor and kiosk computers

For a shared PC where several people sign in one after another, a FIDO2 security key per person (touch plus PIN) works well because no phone is needed. A cheaper variant: Windows Hello with each user's own account on the PC. Avoid a single shared account with a shared key taped to the monitor.

Service accounts, scanners and old apps

Scan-to-email devices, accounting software and old mail apps often use passwords with no MFA, or older sign-in methods. A passkey will not fix those, and Microsoft's passkey guidance is about interactive user sign-in. List these devices in your inventory, update or replace the ones that depend on basic authentication, and move scan-to-email to a supported method. If you are unsure which apps still use legacy sign-in, that is a good job for an outside review.

Staff with old phones, no smartphone or no willingness to install apps

Every small business has at least one: the long-serving employee with a basic flip phone, the part-timer who will not put work apps on a personal phone, or the field worker whose phone is six years old. Microsoft's own page makes the main point: Authenticator passkeys need iOS 17 or Android 14 or later (per the sources we read), so a very old phone is out. You still have clean options that need no smartphone at all.

A common objection: "I do not want my employer on my personal phone." A passkey in Authenticator does not give the company access to your photos or messages. It stores a sign-in key for the work account. Still, some people prefer a physical key, and giving them one costs less than a long argument. A reasonable budget is 30 to 70 CAD per key (our estimate, check current retail prices), and each person who relies on a key should have two.

Voice and SMS will not disappear completely for everyone: Microsoft says organizations that need the channel can configure a telephony provider through Microsoft Security Store, with Soprano and Telesign named as the initial private-preview providers, and that this carries a cost. We do not recommend building a small-business plan around it. It is designed for regulated or operationally constrained scenarios, it keeps a weaker method alive, and Microsoft says it is for segments where you have documented a genuine need. For everyone else, passkeys are the default path and Microsoft states that migrating Microsoft-provided SMS and voice users to passkeys incurs no additional cost.

Special cases and gotchas

Self-service password reset

Microsoft's FAQ states the retirement of native SMS and voice applies across Microsoft Entra, including self-service password reset (SSPR), and that users can still use SMS and voice for SSPR through a telephony provider. It also says Microsoft plans to add support for changing a password for users who sign in passwordless. One reseller analysis we read argues that passkeys and Windows Hello do not currently satisfy SSPR, so removing SMS can weaken account recovery while sign-in gets stronger. We could not confirm that from a primary source, so treat it as a question to test: before you remove SMS for anyone, check how that person would reset a forgotten password, and keep an admin-assisted reset as your fallback.

Other countries and travel

Microsoft's FAQ suggests Authenticator verification codes (time-based codes that do not rely on SMS delivery or push notifications) for scenarios such as users in China, and notes these are not phishing-resistant. For travel to places with poor signal, codes and keys work offline. SMS never did.

Conditional Access that demands phishing-resistant MFA

If you have Entra ID P1 or Premium and use authentication strengths, an Authenticator push or code will not satisfy a policy that demands phishing-resistant methods. Test with a pilot user before you roll that policy out widely.

Guests and clients with access to your tenant

If you invite customers, bookkeepers or contractors into SharePoint or Teams, remember that external users fall in the July 1, 2027 group and internal guest users in the February 1 group, as Microsoft defines them. Tell outside collaborators early, because they cannot call you for help at 8 a.m. on the day.

The tenant opt-out is temporary and narrow

Microsoft offers a temporary opt-out, via the Graph setting passkeyDynamicMigration in the authentication methods policy, from the automatic passkey enablement and registration campaign between September 1, 2026 and February 1, 2027. It does not delay the retirement itself. Starting February 1, 2027, the standard timelines apply regardless of the setting. For most small businesses this is not worth the effort. Choose the work, not the delay.

Realistic scenarios (illustrative)

Scenario 1: eight-person accounting office, all on text codes

Realistic scenario, illustrative figures. An accounting office in Laval has eight staff, all using SMS codes, with the owner as the only admin. Week one, the owner reads the registration report and finds 8 of 8 phone-only. She registers a passkey in Authenticator on her iPhone and buys two FIDO2 keys (about 120 CAD total), storing one at home. Week two, two staff pilot. Week three, a 30-minute office session where everyone registers Authenticator and a passkey on their own phone. By week five, 7 of 8 are done and one part-timer with an old phone gets a key. Total owner time: about six hours. Total cash: roughly 170 CAD for three keys. Result: the firm is ready weeks ahead of February 1.

Scenario 2: construction firm with shared tablets

Realistic scenario, illustrative figures. A 15-person contractor has site supervisors sharing two tablets for Outlook and SharePoint, logging in with one common account and a manager's phone for codes. The fix: one named account per supervisor (four extra licences), a FIDO2 NFC key for each supervisor, and passkey registration on their own phones where possible. The shared account disappears. The manager's phone stops being the choke point every morning.

Scenario 3: lockout on a Monday

Realistic scenario, illustrative figures. A salesperson drops her phone in a lake on Saturday. On Monday she cannot sign in because her only method was the passkey on that phone. Because the firm had registered Windows Hello on her laptop as a second method, she signs in on the laptop, removes the dead phone from Security info and registers her new phone. If she had no second method, the owner would verify her by video call, issue a Temporary Access Pass, and she would be back within 30 minutes. The difference between 5 minutes and half a day is the second method.

What this costs: do it yourself or pay a technician

The software side is free: Microsoft says migrating Microsoft-provided SMS and voice users to passkeys incurs no additional cost, and passkeys (FIDO2) are supported in all Entra ID editions without an extra licence. The real costs are time, hardware and the outside help you choose to buy. These are our estimates in Canadian dollars, so treat them as planning numbers, not quotes.

For a typical 10-person business, expect the owner to invest roughly half a working day plus a couple of hundred dollars in keys. IT Cares offers a single 60-minute Expert Consultation at $119.99 CAD if you want a technician to review your tenant with you, check the policy screens and set up the owner account safely. A technician can also connect remotely to walk a reluctant staff member through registration while the owner continues working.

For a wider view of where this fits in your overall security spending, see our budget cybersécurité PME par employé guide (French). Insurers also ask about MFA at renewal, which we discuss in cyber insurance for small businesses in Canada. Phishing-resistant MFA is the kind of control that strengthens your answers.

Pre-change checklist (print or screenshot)

Official Microsoft resources

• Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (Microsoft Learn)
• FAQ for SMS and voice retirement (Microsoft Learn)
• Register a synced passkey (FIDO2) (Microsoft Learn)
• Register passkeys in Microsoft Authenticator (Microsoft Learn)
• Plan a passkey deployment in Microsoft Entra ID (Microsoft Learn)
• Security info (where users manage sign-in methods)
• MC1450133 archive (Message Center item, community-run archive of Microsoft's post)

Also useful on our site: physical security key vs authenticator app, business password manager guide, and what is smishing (SMS phishing), which explains why text-based sign-in was always the weak link. If you want the Microsoft 365 licensing side, see Microsoft 365 in Canada.

When to call a professional

You can do most of this yourself. Call someone if any of the following is true: your tenant has Conditional Access policies you do not understand, you rely on shared accounts you cannot easily retire, you have staff who cannot be reached or are working abroad, you are the only admin and have no recovery plan, or you simply would rather spend Saturday elsewhere.

IT Cares has provided remote support, and on-site support in Quebec, since 2014. A technician can connect remotely, read your authentication methods policy with you, set up the owner account and a break-glass plan, and then walk each staff member through registration while you watch. You can book a session online or call 1 (888) 711-9428. A single 60-minute Expert Consultation is $119.99 CAD.

Last verified: November 5, 2026. Microsoft timelines can change, so confirm dates in your own Microsoft 365 admin center Message Center before acting.

Frequently asked questions

Related guides

• Passkeys explained: passwordless login for business
• MFA guide for business owners
• Guide MFA pour PME (FR)
• Fake passkey prompts and Microsoft 365 phishing
• Lost authenticator app: recover 2FA access
• Security key vs authenticator app
• Cyber insurance for small businesses in Canada

Sources and official references

Last verified: November 5, 2026

• Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (opened 2026-11-05, updated 09/23/2026)
• Microsoft Learn: FAQ for Microsoft-provided SMS and voice retirement (opened 2026-11-05)
• Microsoft Learn: Register a synced passkey (FIDO2) (opened 2026-11-05)
• Message Center MC1450133 via community archive, updated Oct 26, 2026 (opened 2026-11-05)
• Microsoft Learn: Register passkeys in Microsoft Authenticator (via search summary, 2026-11-05)
• CloudCapsule: SMS and voice MFA retirement migration plan (secondary, opened 2026-11-05)