Microsoft ends its own text and phone-call sign-in codes for work accounts on February 1, 2027, so staff will soon be asked to set up a passkey.
If you sign in to a work account with a code sent to your phone, that code is going away. Microsoft says it will retire its own text message and voice call codes for work sign-ins starting February 1, 2027. It has again urged the people who run those accounts to move everyone to safer methods first.
The change covers Microsoft Entra ID, the service many companies use to manage work logins. Microsoft said in a Microsoft 365 Message Center update on Tuesday that people should finish moving before the rollout begins, to avoid interrupting sign-ins.
Microsoft's reason is simple. It says texts and voice calls are open to phishing and SIM-swap attacks. Phishing means tricking someone into giving up a code. A SIM swap means a criminal takes over a victim's phone number, so the codes go to the criminal.
Microsoft recommends passkeys, a newer sign-in method built to resist phishing. Admins can also choose QR code sign-in, FIDO2 security keys (small physical keys) and other methods Entra ID supports.
This has been coming for a while. In July, Microsoft said passkeys would become the default sign-in experience for Entra ID starting in September. As that reaches each organization, users who have text or voice sign-in turned on are automatically enabled for passkeys. The next time they use multifactor authentication, they will be asked to register one. In August, Microsoft also ended text-message first-factor sign-in for Entra ID Free tenants.
The change hits organizations that use Entra ID for workforce sign-in, and their employees. Business owners with a Microsoft work setup should check how their staff log in today. Employees should expect a prompt to register a passkey.
Customer sign-ins are not part of this. Microsoft says the retirement does not apply to Azure AD B2C or Microsoft Entra External ID, the services used for customer identity. Personal accounts are not mentioned in the material.
The alert box above lists the steps. In short: find who still relies on phone codes, move them to a safer method, and tell staff what to expect. Companies that truly need phone codes can keep them by setting up a third-party phone provider through the Microsoft Security Store.
Microsoft has said it will stop offering text and voice as a built-in Entra feature after February 1, 2027. The material does not say exactly when the rollout reaches each organization, or what a third-party phone provider will cost. Admins should watch the Microsoft 365 Message Center for updates and start the move now.
If your work uses Microsoft sign-in, plan the move to passkeys now, because text and voice codes stop working as a built-in option on February 1, 2027.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
