Microsoft Is Retiring Texted Login Codes. What Small Businesses Should Do Now.

Correction, September 26, 2026: This post said that staff already using the Microsoft Authenticator app would be passed by quietly. That is wrong: what puts an account in scope for the September 1 passkey enrollment and nudge is whether it is still enabled for text or phone codes in the Entra Authentication Methods Policy, not which method the person uses day to day. Two dates below also need a caveat Microsoft added on September 16 and September 23, after this post went up: February 1, 2027 retires Microsoft-provided text and phone codes for everyone except Global Administrators and external users, who move to July 1, 2027. Internal guest users stay on February 1. Our full update on all of it, including the blocking sign-in prompt and the temporary opt-out Microsoft has documented, publishes on September 30, 2026.

If your team signs in to Microsoft 365 and gets a verification code by text message, that method now has an expiration date. Microsoft has confirmed the change and published the dates in plain sight, so there is no rumor to chase and no reason to panic. You have real runway, and the businesses that move early will barely notice the switch.

Here is the calm way to get ahead of it.

What Is Actually Changing

Two dates matter. Starting September 1, 2026, passkeys become the default sign-in prompt in Entra, the identity system behind Microsoft 365. Then on February 1, 2027, Microsoft retires its own text-message and phone-call verification codes for everyone except Global Administrators and external users, who follow on July 1, 2027. After the date that applies, texted and called codes only keep working if a business contracts a telephony provider through the Microsoft Security Store, and Microsoft says that costs money.

A passkey is a sign-in tied to your device or a physical key. There is no code to read aloud, intercept, or be talked into sharing, because there is no code at all. An authenticator app with number matching sits in the same family: something an attacker cannot phish out of a distracted employee over the phone.

One thing to be clear about, because it causes real confusion: multi-factor authentication is not going away. It is getting stronger. Only the text-and-call method is being retired. If anyone tells you "Microsoft is turning off MFA," they have it backwards.

Why Microsoft Says It Is Doing This

Microsoft's own answer is security. Its FAQ says: "The primary driver is security. As the industry moves toward phishing-resistant authentication, Microsoft Entra ID is making passkeys the default authentication experience." A criminal who takes over a phone number by SIM swapping receives the very code that was supposed to protect the account, an attack that has cost people real money. A passkey removes the code from the equation entirely, so there is nothing to steal in transit.

Who This Affects

Anyone in a Microsoft Entra tenant with users still enabled for text or phone codes in the Authentication Methods Policy, whether or not those staff ever actually receive one. Staff who use the Microsoft Authenticator app every day can still be in scope if that setting is still on for them. Staff already signing in with a passkey or Windows Hello for Business can carry on with those methods. The accounts to move first are the ones still enabled for the text-code method in the policy.

What To Do, In Order

You have months, not days, so use them deliberately instead of scrambling at the deadline.

1. Inventory who still receives a code by text or call. This is the whole job in one step: you cannot move people you have not counted.
2. Move those staff to a passkey or the Microsoft Authenticator app, and remove SMS and voice from their entry in the Authentication Methods Policy. Leaving the text-code method enabled is what keeps an account in scope.
3. Decide whether any device or line-of-business system truly needs a backup telephony provider, or whether you can retire the texted-code path completely.
4. Do it before February 2027, not on it. The organizations that wait until the deadline are the ones whose staff get blocked at sign-in until they register a passkey.

How Comserv Handles This for Clients

Across our own clients, staff sign in with an authenticator app rather than texted codes. That does not by itself put those accounts out of scope: what decides it is whether text and phone codes are still enabled for them in the tenant policy, and we are going through that account by account. When we move a business off texted codes, the part that takes care is timing: making sure each person has a passkey registered before their old method stops working. That is a planning problem, not a hard technical one, and it is exactly the kind of thing worth handing to someone who does it for a living.

If you are an owner reading this and worrying about your staff losing access, call us and we will plan the move with you, one account at a time.

Want to know where your business stands before the deadline? Book a free strategy call or call (347) 273-1200, and we will walk through your sign-in setup with you.