Microsoft is retiring SMS and voice calls as a second factor for business accounts from 1 February

What happened

Microsoft is going to stop sending its own SMS codes and voice calls, which many companies use as a second factor to sign in to Microsoft 365. The change affects Microsoft Entra ID, the service that manages Microsoft 365 work accounts.

According to Microsoft's official documentation, passkeys have been the default sign-in method since 1 September 2026, and from 1 February 2027 Microsoft-provided SMS and voice will stop working for all users except Global Administrators and external users, who have until 1 July 2027.

Microsoft explains it like this: SMS and voice are "among the most vulnerable authentication methods available today" and "provide significantly weaker protection against phishing and account compromise than passkeys". This week the company again urged administrators to move their users to these methods, according to BleepingComputer.

What we know

• Since 1 September 2026, users who have SMS or voice enabled are prompted to register a passkey when signing in. For now they can postpone it.
• From 1 February 2027, anyone whose only second factor is SMS or a voice call will have to register a passkey during sign-in to keep accessing their account. That prompt can no longer be skipped. Microsoft stresses there is no opt-out.
• Codes from an authenticator app (such as Microsoft Authenticator) remain supported after 1 February, and users who use them won't get that mandatory prompt. Microsoft points out that they aren't phishing-resistant either.
• Organisations that need to keep using SMS can contract a telephony provider through Microsoft Security Store from 30 October 2026. It has a cost, which varies by provider and region. Moving to passkeys has no additional cost.

Why it matters

For years SMS was the easiest way to turn on two-step verification, which is why it is still very common in small companies. But a code that arrives by SMS can be stolen: a fake website can ask you for it and use it straight away, and a duplicate SIM card can divert it. Passkeys, according to Microsoft, use cryptographic keys instead of shared secrets and resist phishing, SIM swapping and credential replay.

Microsoft retiring SMS is good news for security. The risk lies in doing it in a rush: if nobody prepares the change, on 1 February several employees will all run into a screen that forces them to set up something new before they can open their email.

What it means for an SME

In many SMEs, Microsoft 365 was set up by the IT provider years ago, with SMS as the second factor because it was the easiest option. Since then:

• nobody knows for sure which employees use SMS and which use the app;
• there are shared accounts or accounts of former employees tied to the mobile of someone who has left;
• the Global Administrator is sometimes the owner's own account, with SMS as the only method.

What your company should do this week

1. Ask whoever manages your Microsoft 365 for the list of users still on SMS or voice calls. Microsoft publishes a script to get it.
2. Agree a plan to move them to the Microsoft Authenticator app or to passkeys before January, group by group and with a simple explanation for the team.
3. Start with administrator accounts and with the people who handle payments or invoices: those are the ones most worth protecting.
4. Review accounts nobody uses or that depend on a former employee's mobile: it's a good time to close them. We explain it in our guide to MFA (in Spanish).
5. Only if there's a real reason to keep SMS, ask for a quote for the Microsoft Security Store telephony provider. For most SMEs, passkeys or the app are the safest option and cost nothing.