For the last ten years, the advice has been simple: turn on two-factor authentication. Type your password, then type the six-digit code that arrives by text message or phone call. It stopped a huge number of attacks, and it was far better than a password on its own.
That advice is now changing. Microsoft is retiring text message and phone call codes for Microsoft 365 sign-ins and making passkeys the default. Google, Apple and the UK’s National Cyber Security Centre (NCSC) are all heading the same way. If your business uses Microsoft 365, this will affect your staff over the next few months.
What Microsoft is changing
In July 2026 Microsoft announced that passkeys would become the default way to sign in to Microsoft Entra ID, the system behind every Microsoft 365 work account. The key dates are:
- 1 September 2026: Microsoft started switching passkeys on for anyone who currently uses a text or phone call code. Staff are now being asked to set up a passkey when they sign in. They can skip it for now.
- 1 February 2027: Microsoft stops sending text message and phone call codes for most users. Passkeys become compulsory for everyone in scope, and the temporary opt-out ends.
- 1 July 2027: The same happens for Global Administrators and guest users from other organisations.
After those dates, the only way to keep text or phone codes is to pay a separate telecoms provider through the Microsoft Security Store, and Microsoft is clear that it does not recommend it. Passkeys are included in every Microsoft 365 plan at no extra cost.
The Microsoft Authenticator app, hardware security keys, Windows Hello and authenticator app codes all carry on working. It is only Microsoft’s own text message and phone call codes that are going.
Why text message codes are no longer good enough
Text and phone codes were never perfect, but they were good enough when most attacks were someone guessing a password. Criminals have moved on, and there are three big problems.
They can be phished. Fake login pages no longer just steal your password. They sit between you and the real Microsoft page, pass your details through in real time, and when you type in the code from your phone, they use it straight away. You sign in, so does the attacker, and nothing looks wrong. These kits are cheap and widely sold, and AI has made the emails that lead to them much more convincing.
Phone numbers can be stolen. In a “SIM swap”, a criminal persuades a mobile network to move your number to a new SIM card. From then on, your codes go to them.
People can be talked into handing them over. Some of the most damaging UK attacks of recent years started with someone on the phone pretending to be IT support or a colleague, and asking for “the code we’ve just sent you”. A code that can be read out can be given away.
The NCSC now describes text message codes and other traditional two-step methods as “inherently phishable”. In April 2026 it said it will recommend passkeys wherever a service supports them, with traditional two-step verification only as a fallback.
What is a passkey?
A passkey replaces both your password and the code. Instead of typing anything, you confirm it is you with your fingerprint, your face, or your device PIN, on your phone or computer.
The clever part is that a passkey is tied to the real website it was made for. If you land on a fake Microsoft login page, your passkey simply will not work there, because it knows it is not the real site. There is no code to type into the wrong place and nothing to read out over the phone. That is why it is called phishing-resistant.
Passkeys can live in a few places:
- On your phone, in the Microsoft Authenticator app, or in Apple or Google’s password manager.
- On your computer, through Windows Hello or Touch ID on a Mac.
- On a physical security key, such as a YubiKey.
Where YubiKeys come in
A YubiKey is a small hardware security key, about the size of a house key, that plugs into a USB port or taps against a phone. It holds passkeys on the key itself, so they cannot be copied off it, and it needs no battery, no signal and no app.
Security keys make the most sense for:
- Administrators and anyone with access to sensitive systems, such as finance, payroll or client records. These are the accounts attackers want most.
- Staff who cannot or should not use a personal phone for work, or who work somewhere without reliable mobile signal.
- Shared or frontline roles, where people move between computers.
- A backup, so that a lost or broken phone does not lock someone out.
Expect to pay roughly £30 to £60 per key, and most people should have two: one in daily use and a spare kept somewhere safe. We practise what we preach here: our own engineers sign in to client systems with hardware security keys, because an engineer’s account is exactly the kind an attacker would target.
It is not just Microsoft
- Microsoft personal accounts (Outlook.com, Xbox, Hotmail) have been passwordless by default for new users since 2025.
- Google has made passkeys the default for personal Google accounts and is moving away from text message codes for Gmail.
- Apple builds passkeys into every iPhone, iPad and Mac, and syncs them through iCloud Keychain.
- Banks, online shops and other services are adding passkeys too.
The direction is clear. Within a couple of years, a text message code will look as out of date as a password written on a sticky note.
What your business should do now
If you use Microsoft 365, don’t wait until February. Staff are already seeing the prompts, and a rushed switch in late January is how people get locked out.
- Find out who still uses text or phone codes. Your Microsoft 365 admin centre can show which sign-in methods each person has set up.
- Tell staff what is coming. A short message saying “you will be asked to set up a passkey, it’s genuine, please do it” stops people ignoring the prompt or worrying it is a scam.
- Decide who needs a security key. Start with admins, directors and anyone handling money or personal data.
- Plan for lost phones. Make sure every person has a second way in, such as a spare security key, and that your process for resetting someone’s sign-in checks who is really asking. A strong passkey does no good if a criminal can phone in and get it reset.
- Check your shared and older devices. Shared mailboxes, meeting room screens, scanners that send email and older software may need a different approach.
- Use Conditional Access to insist on phishing-resistant sign-in for your most sensitive accounts, rather than leaving it to choice.
QLine IT clients
If we manage your Microsoft 365, we are already working through this for you. We are checking which of your users still rely on text or phone codes, and we will be in touch to agree a plan, including who should have a security key, before Microsoft’s February 2027 deadline. If staff ask whether the passkey prompt is genuine, it is, and they should go ahead. If they are not sure, they can contact us and we will help them set it up.
Not a QLine IT client?
If you are not sure how your staff sign in today, or you would like help moving to passkeys and security keys without disruption, contact us. We can check your Microsoft 365 setup, tell you what needs to change before February, and supply and set up YubiKeys for the people who need them.
IT Solutions
QLine IT is Cyber Essentials Plus accredited and a Microsoft Solutions Partner. We look after businesses, charities and children’s homes across Leeds and the UK, and help them keep up with changes like this before they become a problem. If you would like to talk about your own systems, speak to us.
