If your staff still sign in to Microsoft 365 by typing a code that arrives by text message, that option has an expiry date now. Microsoft has announced the retirement of its own SMS and voice-call authentication in Entra ID (the service behind Microsoft 365 logins), and the timeline is short enough that a professional office should start planning this quarter, not next year.
I run an IT firm in Barrie that works with accounting, insurance, and other professional offices, and this is the kind of change that looks small until the week it isn't. A text-message code feels like it's been part of logging in forever. Here's what's actually changing, why, and how to move your office off it without locking anyone out on a filing deadline.
What exactly is changing, and when
Microsoft's timeline, from their own retirement documentation:
- September 1, 2026 (already in effect): passkeys are automatically enabled for any user set up for SMS or voice, and users start seeing prompts to register a passkey at sign-in. By default, users can snooze that prompt indefinitely — which is exactly why you shouldn't leave this on autopilot.
- February 1, 2027: Microsoft-provided SMS and voice authentication is retired for most users. If your only MFA method is a text code, you'll be forced to register a passkey during sign-in before you can get back into your account. Self-service password reset by text is affected too.
- July 1, 2027: the same retirement lands for Global Administrators and external users (internal guests stay on the February date).
There is a paid workaround — contracting a third-party telephony provider through Microsoft's store — but that's for organizations with a genuine regulatory or operational reason to keep texting codes. For most offices, the right move is to migrate, not to pay to stand still.
Why Microsoft is doing this
SMS is one of the weakest second factors available. A code sent by text can be intercepted through SIM-swap fraud, phished with a convincing fake login page, or read off a lock screen. The industry — and Canadian cyber insurers — have been moving toward phishing-resistant authentication for years, and passkeys are Microsoft's destination. The retirement isn't a surprise; it's Microsoft dragging the holdouts along.
Why this matters more for professional offices
Two reasons specific to accounting, insurance, and law practices in Simcoe County and York Region.
First, your Microsoft 365 tenant holds everything a criminal wants from you: client files, trust-related correspondence, CRA and broker portal credentials, and the email history that makes convincing follow-up fraud possible. A phished text-code account is the cheapest way in.
Second, this connects directly to the cyber insurance application questions offices are already seeing. Insurers ask what kind of MFA you run, not just whether you ticked a box. "Text message codes, being forced off in February" is not an answer you want to give at renewal — "phishing-resistant MFA enforced for all staff" is.
What to do now — in order
1. Find out who's actually on SMS or voice
You can't plan a migration you haven't measured. A report of each user's registered authentication methods will tell you within minutes whether you have three users on text codes or thirty — and which of your admins are included. If the answer is nobody, you're done reading and ahead of most offices.
2. Decide what replaces it
The realistic ladder, from easiest to strongest:
- Authenticator app push approvals — the practical first step for every staff member with a phone. Not phishing-proof, but a large step up from text codes and no hardware required.
- Passkeys — bound to the device and phishing-resistant by design. This is where Microsoft is steering everyone, and for most office staff the experience ends up simpler than typing codes: a fingerprint or PIN on the laptop they already use.
- Hardware security keys for the accounts that matter most — especially admin accounts.
For a 10–50 seat office, a common landing zone is passkeys for everyone, hardware keys for the two or three people with admin access, and app-based approval as the fallback during transition.
3. Don't let the snooze button win
Because users can dismiss the passkey prompt indefinitely by default, a hands-off migration quietly becomes "nobody migrated." Set a real deadline, communicate it, and enforce it. February 1 will enforce it anyway — the only question is whether that happens on your schedule or Microsoft's, with your office mid-tax-season or mid-renewal.
4. Handle the edge cases before they become support calls
Every office has them: the partner who works from an iPad, seasonal staff with no company phone, the shared mailbox that a vendor still verifies by phone call, external accountants or brokers who access your tenant as guests (they're on the February timeline, not July). These are the cases that turn a one-day change into a bad week. Identify them now.
5. Roll out in waves, not overnight
Pilot with a handful of willing users, fix what surprises you, then wave through the rest of the office. Registration takes each user a few minutes; the work is in the sequencing and the communication, not the technology.
6. Pair the migration with Conditional Access
MFA on its own answers "did you prove who you are." Conditional Access adds "and are you doing it from a healthy, known device, from a plausible place." Requiring compliant, Intune-managed devices for access to your Microsoft 365 data is what turns the login change into an actual security posture — and it's the piece most offices never configure because it's the piece that needs real endpoint management behind it.
The mistake I'd warn against
Waiting. The failure mode I expect to see in early 2027 is an office that ignored the sign-in prompts, then has the entire team hit the forced passkey registration on the same morning — each of them fumbling through it, some without a usable fallback method, all while trying to hit a client deadline. The technology is ready. The timing is the risk.
If you'd rather this be somebody's explicit project than an unpleasant surprise, that's exactly the kind of tenant cleanup we do. See our managed IT plans and Microsoft 365 support in Barrie pages for what that looks like, or just ask — I'd rather answer the question in October than the outage in February.