How you log into 365 is changing
If you currently use a text message or telephone call as an authentication method, you will need to move to a phishing-resistant method. Microsoft recommends passkeys.
What is happening
• Passkeys are becoming the default authentication experience in Microsoft Entra ID for users currently enabled for SMS or voice.
• Microsoft-provided telecom delivery for SMS and voice authentication will be retired.
• Customer-managed telecom providers configured through the Microsoft Security Store are not affected.
When is it happening?
| 1 September 2026 | Users enabled for SMS or voice are automatically enabled for passkeys and will be prompted to register a passkey when they next complete MFA. |
| 1 February 2027 | Microsoft-provided SMS and voice authentication are fully retired in Microsoft Entra ID. |
| After 1 February 2027 | A user whose only available MFA method is SMS or voice will receive a blocking prompt to register a passkey before continuing to sign in. Microsoft states that there is no opt out from this enforcement. |
Who will it affect?
Affected: Microsoft 365 users in a Microsoft Entra ID tenant who are enabled for SMS or voice authentication, particularly anyone whose only available MFA method is SMS or voice.
No action required: If no users in the tenant are enabled for SMS or voice, Microsoft says no action is required.
Exception: Customer-managed telecom providers configured through the Microsoft Security Store are unaffected by the retirement of Microsoft-provided delivery.
Recommended user action
Do not wait until sign-in is blocked.
When your organisation asks you to register a passkey, follow its instructions promptly. If you currently depend on text messages or telephone calls for authentication, contact CPLUS Support for the approved migration route.
Why Microsoft is making the change
Microsoft says SMS and voice are significantly weaker than passkeys against phishing, SIM-swap and replay attacks. The move is intended to provide stronger, phishing-resistant authentication by default.
Important note
Your organisation may issue additional instructions about which passkey method to use and how to register it. Follow your internal IT guidance. This briefing summarises the changes and does not replace organisation-specific security policy.
For more information, please email customer.services@cplus.co.uk
