Signed in to Outlook or Teams at work lately and been asked to "set up a passkey"? You probably tapped Skip. Most of us treat that prompt like a software update reminder. This one has an end date.

The short answer: from 1 February 2027, Microsoft stops sending sign-in codes by text message or phone call for work and school accounts. If a text code is your only second step, your next sign-in after that date stops at a passkey setup screen you cannot skip. Microsoft's retirement page is blunt about it: "There is no opt out."

What changes, and when

The change sits in Microsoft Entra ID, the sign-in system behind work and school Microsoft 365 accounts. It arrives in four steps.

Microsoft's timeline for retiring text and call codes

Date	What happens	Who it covers
1 Sep 2026	Passkeys switched on; a setup prompt appears at sign-in, and Skip works	Users with text or call codes
30 Oct 2026	Paid third-party text and call delivery opens in Microsoft Security Store	Organisations that must keep codes
1 Feb 2027	Microsoft stops sending the codes; the prompt can no longer be skipped	Everyone except Global Administrators and external users
1 Jul 2027	The same retirement	Global Administrators and external users

Internal guest accounts follow the February date, not July. Organisations that sign up with a telephony provider can keep codes, at a cost that Microsoft's retirement FAQ says varies by provider and region. Moving people to passkeys costs nothing extra.

Why Microsoft is dropping text codes

It has been warning about them for years. In a 2020 post on Microsoft's identity blog, Alex Weinert wrote that SMS and voice "were designed without encryption". He listed the results: intercepted messages, call forwarding attacks and SIM swaps. He also reported delivery rates as low as 50% in some regions.

A passkey works differently. It is a cryptographic key kept on your device and unlocked with your fingerprint, face or PIN. It only answers the real sign-in page, so a fake login site gets nothing it can reuse. Microsoft calls passkeys resistant to phishing, SIM swaps and replay attacks. Our passkey adoption explainer shows how common they have become.

Does this affect you?

• Yes, act now: your work or school account's only second step is a text or a call. Open Security info. If the only method besides your password is a phone number, that is you.
• Yes, by July: you are a Global Administrator, or an external user signing in to another organisation.
• No blocking prompt: you already use a passkey, Windows Hello, a security key, Authenticator approvals or authenticator app codes. The skippable nudge may still appear.
• Not on this timeline: personal Outlook.com, Hotmail and Xbox accounts. They are not Entra ID accounts.

Switch to a passkey in five steps

Microsoft's Authenticator guide recommends creating the passkey inside the app. Your IT team's policy decides what the app sets up.

1. Check your phone. A passkey in Microsoft Authenticator needs iOS 17 or later, or Android 14 or later. Our phone update guide shows where to find your version.
2. Add the work account. In Authenticator, tap Add work or school account and sign in. If the account is already there, tap it, then Create a passkey.
3. Make Authenticator a passkey provider. On an iPhone, open Settings, General, AutoFill & Passwords, and pick Authenticator (on iOS 17, Settings, Passwords, Password Options). On Android, open Passwords & accounts and tick Authenticator under Additional providers. Menus vary by phone maker.
4. Confirm it stuck. Reopen Security info and check that the passkey is listed.
5. Test it once. Sign out of one work app and back in with the passkey, while text codes still work as a backup.

Prefer a laptop? In Security info, choose Add sign-in method, then Passkey in Microsoft Authenticator, and follow the prompts to your phone.

No smartphone, or no work apps on your own phone?

You have other routes, and your IT team decides which are allowed. Microsoft lists Windows Hello on a work PC and hardware security keys as phishing-resistant options. The default passkey setting Microsoft switched on in September also accepts passkeys synced through iCloud Keychain or Google Password Manager.

Codes from an authenticator app also survive. The FAQ says they keep working after 1 February where your organisation allows them, and people who use them do not get the blocking prompt. They are not phishing-resistant, though, so treat them as the stopgap they are.

If you lose the phone

A passkey in Authenticator lives on that one phone. If it goes missing, your IT team can issue a Temporary Access Pass. That is a time-limited code, valid from ten minutes to 30 days depending on policy, which lets you sign in and register a new method. Afterwards, delete the old passkey from Security info.

Easier still, register two methods now: say, the phone passkey plus Windows Hello on your work laptop. Our guide to losing a phone that holds your passkeys covers recovery in more depth.

A worked example

Here is a hypothetical. Meera, an accounts executive, gets her work sign-in codes by text on a basic feature phone. She has skipped every passkey nudge since September.

On Monday, 1 February 2027, her first sign-in that asks for a second step stops at the passkey screen. A feature phone cannot hold a passkey, and there is no Skip. Her Monday morning turns into a help-desk ticket.

Had she checked Security info in November, the gap would have shown up early. Her IT team could have sent a security key or set up Windows Hello on her laptop, with weeks to spare.

If you run a small company's Microsoft 365

• Find who still relies on texts or calls. Microsoft publishes a usage script for this.
• Do not count on the opt-out. The temporary opt-out only pauses the automatic passkey switch-on and nudges until 1 February. Enforcement still applies.
• Plan password resets. Self-service password reset by text or call retires too, the FAQ says.
• Prepare the stragglers. Line up Temporary Access Passes and a few security keys for staff without suitable phones.

That prompt you keep skipping is a courtesy with an expiry date. Set up the passkey while Skip still works.