Passkeys become the default: Microsoft retires SMS codes

Passwords and SMS codes are the most common way attackers get into business accounts. Microsoft is now acting on that: for business accounts in Microsoft Entra ID, which includes most SME Microsoft 365 accounts, passkeys become the default sign-in method. Sign-in with SMS or voice-call codes is set to disappear entirely.

The deadlines

• Since 1 September 2026: users who rely on SMS or calls as a second factor are prompted to set up a passkey when they sign in.
• From 1 February 2027: according to Microsoft's announcement, it retires its own SMS and voice authentication in Entra ID. Anyone without a passkey or another phishing-resistant method must set one up before their next sign-in.

What is a passkey?

A passkey replaces both password and SMS code. It is a key pair: the private key stays on your device, such as your phone or laptop, and is unlocked with your fingerprint, face or PIN. The server only knows the public key. Because the passkey is bound to the genuine website, it simply does not work on a fake phishing page.

Why this is good news for SMEs

• Phishing fails: even someone who clicks a fake link cannot give away their passkey.
• No SIM swapping: attacks via hijacked phone numbers stop working.
• Faster sign-in: a fingerprint instead of typing a password and waiting for a text.

How to prepare your team

1. Take stock: who still signs in with SMS or calls? You can check this in the Microsoft 365 admin centre.
2. Sort out devices: does everyone have a phone with Microsoft Authenticator or a laptop with Windows Hello? For staff without a smartphone, FIDO2 security keys work well.
3. Hand out a short guide: one page with screenshots saves a lot of questions.
4. Plan for lost devices: what happens if someone loses their phone? A second registered passkey or a stored security key prevents lockouts.
5. Finish before February 2027: switching early avoids stress on a Monday morning.

Bottom line

The switch is not a big project, but it should be planned. For a team of ten, half a day is often enough. As part of our IT support we are happy to handle it for you, including a guide for your team.