Microsoft SMS MFA Retirement: What to Do Before February 1, 2027

Yes, Microsoft will stop sending sign-in codes by text message or phone call to most Microsoft 365 work accounts on February 1, 2027. Anyone whose only second step is a text or call will then have to set up a passkey before they can sign in. Microsoft’s own SMS MFA retirement page sets three dates.

• Microsoft began rolling out a passkey prompt at sign-in for staff still set up for text or call codes on September 1, 2026. Staff can snooze it until February 1, 2027.
• From February 1, 2027, the texts and calls stop for your staff. For anyone with no other method, the nudge becomes a stop sign that only a new passkey clears.
• Your top-level admin accounts, which Microsoft calls Global Administrators, and outside guests who sign in to your files get until July 1, 2027. Every other account follows February 1. Move the admins first anyway, because those are the accounts criminals want most.

This covers work accounts, the sign-in behind Outlook, Teams and your Microsoft 365 files. Personal Microsoft accounts are a separate change, covered in the FAQ below. Tell your managers the date this week, and move your own sign-in first.

Microsoft is dropping them because a code sent to a phone number is the easiest second step for a criminal to steal. Microsoft’s FAQ calls texts and calls “among the most vulnerable authentication methods available today.”

1. Phishing takes the code from your own staff. A fake Microsoft login page asks for the password, then for the code that just arrived. CISA, the federal cyber agency, rates text and voice codes the weakest form of MFA and says to use them only as a last resort.
2. A SIM swap takes the phone number itself. A criminal talks the carrier into moving your number to their phone, so your codes land on their screen. The FBI logged 971 SIM swap complaints and $17.4 million in losses in 2025.
3. Texts are sent through the phone network as plain, readable messages. After the 2024 break-ins at US phone carriers, CISA told senior officials and others at special risk to stop using SMS as a second factor. NIST, the federal standards agency, lists phone codes as a “restricted” sign-in method.

A passkey closes all three doors, because it cannot be typed into a fake page, texted to the wrong phone or read on the way. Tell your staff that nobody will ever call or text asking for a code, and share our guide to spotting a phishing email.

A passkey replaces the text code, and everyone should move to one. It is a sign-in key stored on the phone and unlocked with the face, fingerprint or PIN the person already uses, with no code to type. The free Microsoft Authenticator app is the simplest place to keep it. Staff who already use that app for tap-to-approve do not have to do anything in February, because tap-to-approve is not being retired. We still recommend they add a passkey inside the same app.

CISA’s fact sheet above says a fake page can still trick an app prompt, and Microsoft calls passkeys almost impossible to phish. Staff who cannot use a phone at work get a small USB security key, from $29 at Yubico, that does the same job. Set up a passkey on your own phone before your staff do.

If you do nothing, anyone whose only second step is a text or call will meet a sign-in screen they cannot skip. February 1, 2027 is a Monday, so those calls hit your help desk first thing. The text option for resetting a forgotten password ends the same day.

Most firms will never need the one exception. From October 30, 2026, a firm with a regulatory or hard operational need to keep texts can pay an outside carrier listed in a Microsoft marketplace. Microsoft’s announcement says the firm pays that bill. Put February 1, 2027 on the firm calendar and name the person who owns it.

Treat it as a project of a few weeks, up to three months for the largest firms, made up mostly of emails and reminders. At one team a week, a 60-person firm with six teams is done in about eight weeks, admins and pilot included. We can run it one team at a time while texts keep working as the safety net, so start this fall. Microsoft’s retirement page says coordinated communication is “the single biggest predictor of a smooth passkey rollout,” so most of the work is telling people what to expect.

1. Get the count of people who still rely on a text or call. Your provider pulls it from Microsoft 365.
2. Move the admin accounts first, in week one.
3. Run a pilot with five people, including you, and ask what confused them.
4. Roll out one team a week. Each team gets a short email and a one-page guide, and Microsoft’s own nudge does the reminding.
5. Turn texts off for each team once it is on passkeys, so a stolen code is useless.

Network Doctor already sets up multifactor authentication for its managed IT clients and has been a Microsoft partner since 2010. We have also seen what a stolen password can do. Our security team once caught an attacker signing in with a client’s stolen credentials at 11:23 on a Friday night and shut it down in 27 minutes. Pick your five pilot people this week, and if nobody can produce the count, we can.

For most firms the move costs staff time and no new software. Microsoft’s FAQ says moving from text codes to passkeys adds no license cost, and the Authenticator app is free on every Microsoft 365 plan. No plan change is needed either. On Microsoft 365 Business Premium, your provider can make passkeys required for everyone, and on the cheaper Business Basic or Standard plans your provider switches texts off one team at a time.

Beyond staff time and your provider’s setup work, the extra costs are optional, about $29 to $58 per hardware key and a carrier bill if you must keep texts. For Network Doctor’s managed IT clients, multifactor authentication setup is part of the service they already pay for. This week, ask your provider which plan you are on and who, if anyone, needs a hardware key.

Microsoft’s 2025 Digital Defense Report calls the phishing-proof kind of MFA the strongest single control once a password has been stolen. A text code fails that test. Victims reported $3.0 billion in business email compromise losses to the FBI in 2025, and many of those scams start with a stolen mailbox login.

In short, texts stop on February 1, 2027, passkeys cost nothing extra, and the move is mostly emails and reminders over a few weeks.

Does this affect personal Microsoft accounts?

No, this change covers work accounts. Microsoft is separately phasing out SMS on personal accounts too, with passkeys and a verified email in its place, and it has given no date.

Will our people be locked out on February 1?

They are held at the sign-in screen until they set up a passkey, and nobody loses an account or a file. With a phone in hand they finish the setup on the spot.

What about staff who will not put a work app on a personal phone?

Give them a hardware security key, or a passkey on their company laptop. Both are passkeys that never touch the personal phone.

Forward this block to whoever runs your Microsoft 365. A tenant that opted out of the September rollout sees no prompt until February 1. The controls live in the Microsoft Entra admin center under Authentication methods. Business Premium’s Entra ID P1 allows Conditional Access authentication strengths, and the Authentication methods policy targets groups. Microsoft’s SMS and voice usage analyzer scans which policies still allow texts and calls, and a Temporary Access Pass covers a lost phone. Legacy per-user MFA settings and self-service password reset (SSPR) text options retire too, so finish the move to the Authentication methods policy. Internal guest accounts stay on the February 1 date. Government clouds follow a later schedule.

Start this week by asking how many of your people still get a text at sign-in. That number is the size of your project.

Send the number to our cybersecurity team, and we will tell you what the move looks like for a firm your size. If you have an IT person in-house, we can run the rollout with them, and our co-managed IT service keeps that support going afterward. Book a call or phone 201-735-7260. We provide managed IT and security to firms across New Jersey, New York and Pennsylvania from our Englewood Cliffs office. If your staff still keep passwords on sticky notes, our note on password managers is the next read.