Microsoft Is Retiring SMS Sign-In Codes in 2027: A Small Business Plan

Microsoft will stop delivering SMS and voice sign-in codes in Entra ID on February 1, 2027, with a later date of July 1, 2027 for Global Administrators and external users. If your staff use text codes for Microsoft 365, move them to passkeys or an authenticator app before then.

This guide is for owners and office managers who run a small company on Microsoft 365 and do not have a full-time IT person. It covers who is affected, what happens if you do nothing, and a six-week plan. Emazoo covers the tools and systems small teams run on, and a login change that arrives on a fixed date is exactly the type of change worth planning before it lands.

What Microsoft Is Changing and When

Microsoft's documentation says Entra ID is making passkeys the default sign-in experience and will no longer provide SMS and voice natively. Starting September 1, 2026, passkeys are automatically enabled for users who are enabled for SMS or voice. The company calls SMS and voice among the most vulnerable methods available.

The timeline has four dates that matter for a small business.

The first date has already passed. If you have users enabled for SMS or voice, some of them may already have seen a prompt to register a passkey. By default, Microsoft's documentation says, users can snooze that prompt without limit.

Note that this applies to public cloud tenants only, according to Microsoft's FAQ. Other cloud environments follow a later schedule.

Is Your Business Affected?

You are affected if anyone in your Microsoft 365 tenant uses a text message or phone call as a second sign-in step. That includes the owner. Many small companies set this up years ago and forgot it.

Microsoft's FAQ says to run a PowerShell script from its public repository to find users who still use SMS or voice, and that any non-zero result means you are in scope. If you work with an outside IT consultant, ask them to run it this week. If you do not, the Entra admin center shows which authentication methods are enabled.

Also check the less obvious accounts. Shared mailboxes, the bookkeeper's login, a part-time contractor's guest account and the person who handles payroll all deserve a look. Our guide to business email compromise and payment verification explains why finance accounts are the first target.

What Happens If You Do Nothing on February 1, 2027?

Users whose only second sign-in method is a text or voice code will see a blocking prompt to register a passkey. They cannot skip it, and Microsoft says there is no opt out for this behavior. They are not locked out for good, but they cannot work until they finish.

That is a real productivity cost on a Monday morning. A ten-person office with eight users in scope can generate eight help requests at once. Planning the change ahead turns that spike into a short, quiet task.

Your Four Options

You have four ways to handle the change. Each fits a different kind of business.

Passkeys are the best fit for most small teams. According to the FIDO Alliance's passkey overview, a passkey is a password replacement that uses public-key cryptography, so the website stores no shared secret that could be stolen. People approve sign-in with the same method they use to unlock a device, such as a fingerprint or a PIN.

Authenticator app codes are a reasonable bridge. Microsoft's FAQ says they remain supported after February 1, 2027, and users who already use them will not get the blocking prompt. They are not phishing-resistant, though, so move administrators and finance staff to passkeys first.

Telephony providers are for companies with a regulated or operational need. Pricing varies by provider and region, and Microsoft says the configuration experience opens October 30, 2026. Most small firms should skip this path, because migrating to passkeys costs nothing extra.

The temporary opt-out exists, but it is a stopgap. It delays the automatic nudges, but Microsoft states there is no opt out for enforcement. Treat it as extra time to finish a plan, not a way to avoid the change. It also requires a technical setting change, so ask your IT consultant before touching it.

A Six-Week Plan for a Small Team

This plan assumes you start in early November and finish before the holidays. Adjust the pace to your team size.

Microsoft recommends a registration campaign to move users at scale without a flood of help requests. In the admin center, an authentication policy administrator can find the setting under Entra ID, Authentication methods, Registration campaign. The documentation says this is the most effective way to move users off SMS and voice.

What to tell your staff

Keep the message short and put it in writing.

At Emazoo, our editors find that a named helper and a ten-minute drop-in session do more than a long memo. People finish setup when someone sits next to them.

Handling the Awkward Cases

Every office has a few. Plan for them before the date.

Staff without a smartphone need another route, such as a hardware security key or a passkey on a work laptop with Windows Hello. Shared accounts are the bigger problem, because a passkey belongs to one person. Move shared logins into named accounts where you can.

Guest and external users follow their own schedule. Microsoft's FAQ says passkey support for business guests and internal guest users is planned by the end of 2026, while external users follow the July 1, 2027 date. Tell your outside bookkeeper, agency and contractors what is coming.

Administrator accounts deserve the most care. Use two Global Administrator accounts, both on passkeys or security keys, and keep one in a safe place. A locked-out administrator is a far bigger problem than a locked-out clerk.

These steps also fit a wider security habit. Our small team account security rollout covers password managers and monthly reminders, and the Microsoft 365 seat audit is a good moment to remove accounts that nobody uses.

What the Change Costs

For most small businesses the cost is staff time. Microsoft's FAQ says migrating Microsoft-provided SMS and voice users to passkeys incurs no additional cost. A hardware key for each administrator is a small purchase, and a telephony provider adds a recurring fee that depends on usage and region.

Compare that to the cost of a compromised account. A stolen login at a company with ten staff can expose email, files and bank approvals in one go. Moving off text codes is one of the cheaper security upgrades available this year.

Microsoft also publishes a passkey deployment guide for administrators who want the technical steps. Hand it to your IT consultant if you have one.

Conclusion

The SMS retirement is a scheduled change with a clear start, not a surprise outage. Count your affected users, choose passkeys or authenticator codes, pilot with a few people and finish before February 1, 2027.

Your next step is small. Ask whoever manages your Microsoft 365 account to list every user who still signs in with a text code. This article reflects public vendor documentation current as of October 28, 2026, and is general information, not individual IT advice. Check Microsoft's pages for your tenant's exact dates.