Passkey connecting a computer and a phone

Passkeys: why Microsoft is dropping SMS and where to set them up

Fabrice BlanchetBlog and news

Microsoft 365 security · Appelez le tech

The text-message code you use to sign in to Microsoft 365 is on its way out. Microsoft is making passkeys the default method and will stop providing SMS and voice-call codes in early 2027. The good news: passkeys are simpler and far more secure. You still need to know where to set them up, and where they are saved.

Sept. 1, 2026passkeys become the default method: Microsoft prompts employees to create one at sign-in
Feb. 1, 2027Microsoft-provided SMS and voice codes stop working for most users
$0passkeys are included in every Microsoft licence, at no extra cost

What’s changing at Microsoft

September 1, 2026Passkeys are turned on by default for users who relied on SMS or voice calls. At sign-in, Microsoft prompts them to create one. They can postpone, but not forever.
February 1, 2027Microsoft-provided SMS codes and voice calls stop working for most users. An employee who only has SMS won’t be able to complete verification and may be locked out.
July 1, 2027The same applies to Global Administrators and guest users.

Businesses that absolutely want to keep SMS will be able to use a third-party telecom provider, at their own cost. For most SMBs, the right move is to switch to passkeys now, at their own pace, rather than in a rush in February.

Why SMS is no longer enough

  • Codes get stolen. A fake sign-in page asks for your password, then your SMS code, and relays them live to the real Microsoft site. The fraudster gets in with you.
  • Phone numbers get hijacked. Through SIM swapping, a fraudster convinces the carrier to move your number to their own SIM card and receives your codes.
  • Scams are getting more convincing. With AI, fake emails and fake pages are nearly perfect. A method that depends on employee vigilance is no longer enough.

A passkey solves all three problems, because there is no code to copy. For a real example of an attack that bypasses traditional MFA, read our article on device code phishing.

What is a passkey?

It is a pair of digital keys created for your account. The public key is given to Microsoft. The private key stays on your device and never leaves it. To sign in, you unlock it with your face, your fingerprint or your PIN, just like unlocking your phone.

Why it’s more secure

The passkey only works on the real Microsoft site. On a fake page, it simply refuses to respond: there is nothing to steal, nothing to copy, nothing to intercept.

Why it’s simpler

No more waiting for a code or typing it in. A glance or a finger on the sensor, and you’re in. Your face and fingerprint stay on the device: they are never sent to Microsoft.

Two kinds of passkeys

Device-bound passkeys

They are created on a single device and never leave it: Microsoft Authenticator on your phone, Windows Hello on your computer, or a physical security key (USB or NFC). Your organization can verify where they come from. This is the recommended choice for a work account.

Synced passkeys

They are copied to the cloud of a password manager (Apple’s, Google’s or a third-party provider’s) and follow the user across all their devices. Convenient, but the passkey ends up wherever that account is signed in, and your organization can’t tell where it has been copied.

Computer or phone?

Our recommendation: both, each with its own role. Having at least two passkeys is also what keeps you from being locked out the day a device is lost or replaced.

Main passkey: your phone

A passkey in Microsoft Authenticator. It goes everywhere with you and lets you sign in on any computer: the screen shows a QR code, you scan it with your phone, and the sign-in is confirmed over Bluetooth.

Everyday passkey: your work computer

A passkey in Windows Hello, on your own computer. Day to day, you sign in with a glance or your PIN, without reaching for your phone.

  • Shared or public computer: no Windows Hello passkey on it. Use your phone’s passkey with the QR code.
  • Executives and administrators: add a physical security key, stored in a safe place as a backup.
  • No company phone: Microsoft Authenticator can be installed on a personal phone. The passkey stays in the app, and your organization has no access to your personal data. Otherwise, a physical security key works great.

Watch where your passkeys are saved. When you create a passkey, your phone or browser may offer to save it in your personal password manager. For your work account, choose Microsoft Authenticator or Windows Hello instead.

A passkey saved in a personal account is copied to every device on that account, including the ones at home. If that personal account is compromised, your work account’s passkey is too. And if you leave the company, the passkey stays in your personal account. If your organization provides a business password manager managed by IT, simply follow its policy.

By contrast, a passkey in Microsoft Authenticator is never synced: it stays on the phone. That’s more secure, but if the phone is lost or replaced, you need to create a new one. That’s why we always recommend a second passkey, on your computer or on a physical key.

Creating your passkey, step by step

1. Install Microsoft AuthenticatorFrom the App Store or Google Play, and add your work account.
2. Open your security infoOn a computer, go to mysignins.microsoft.com/security-info and sign in.
3. Add a sign-in methodChoose Passkey in Microsoft Authenticator and follow the prompts: scan the QR code with your phone, then confirm with your face, fingerprint or PIN.
4. Add your computer’s passkeyOn your work computer, repeat the process and choose the option to save the passkey on this Windows device (Windows Hello).
5. Test itSign out, then sign back in with your passkey. You can then remove SMS from your methods, if your organization allows it.

Exact labels may vary slightly depending on your version of Windows, your phone and the app.

Frequently asked questions

I lost or replaced my phone.

Sign in with your second passkey (the one on your computer or a physical key), then remove the old phone from your methods and create a new passkey. If you have no passkey left, your IT support can give you temporary access to register a new one.

Does it work on a Mac or an iPad?

Yes. The simplest way is to use the Microsoft Authenticator passkey on your phone: the Mac shows a QR code, you scan it, and you’re done.

Is my face or fingerprint sent to Microsoft?

No. They are only used to unlock the passkey on your device. Microsoft only receives a signature proving the passkey is the right one.

What about Microsoft Authenticator “Approve” notifications?

They remain available, but a notification can be approved by mistake, or at the request of a fraudster on the phone. A passkey is phishing-resistant: it’s the method to favour.

For executives and IT managers

  1. Find out who still depends on SMS using the authentication methods report in Microsoft Entra.
  2. Plan the transition before February 2027. A temporary opt-out is available until February 1, 2027, but not beyond.
  3. Decide which passkey types are allowed using passkey profiles: device-bound passkeys for administrators, and possibly synced passkeys for everyone else.
  4. Plan the first registration of new employees with temporary access, and a clear procedure for lost devices.
  5. Communicate before Microsoft does: a simple email explaining what to do prevents a lot of support calls.

Want the switch to passkeys to happen without locking out your employees?

Appelez le tech · 1 833 444-1041

Sources