Microsoft passkeys are about to become a much bigger part of how Microsoft 365 users sign in. On 1 February 2027, a Microsoft 365 user whose only second factor is a text message will meet a passkey registration prompt at sign-in that they cannot dismiss. Microsoft says directly that users will not lose access to their accounts. Instead, Microsoft will stop them at sign-in until they register a passkey. They must complete the registration before they can reach their mailbox. Since 1 September 2026, Microsoft has automatically enabled passkeys for users who rely on SMS or voice and has prompted them to register, while still allowing unlimited snoozes until the relevant retirement date. That snooze is why the change has been easy to miss. There is also more than one date, and they do not all fall on the same people.
Microsoft passkeys arrive in two waves, not one
The coverage of this change tends to give a single date. There are three, and they apply to different people in your business.
| Date | What happens | Who it covers |
| 1 September 2026 | Passkeys become the default. Users enabled for SMS or voice are auto-enabled for passkeys and nudged to register at sign-in, with unlimited snoozes | Everyone currently on SMS or voice |
| 1 February 2027 | Microsoft-provided SMS and voice retire. The prompt becomes blocking for users whose only available MFA method is SMS or voice | All users except global administrators and external users. Internal guests are included |
| 1 July 2027 | Same retirement, same blocking condition | Global administrators and external users only |
Microsoft’s retirement notice makes the scope clear. Microsoft will retire its SMS and voice delivery for all users except global administrators and external users. Internal guest users still fall under the February deadline.
Read that carefully, because the wording separates two groups most people treat as one. An external user is a genuine outsider signing in to your tenant. An internal guest is an account that your organisation has added to the directory and assigned guest status. Businesses often use this setup for contractors, part-time bookkeepers and agency staff. Those accounts follow February, not July. The reasoning behind the retirement, and what replaces a text message, is set out in phishing-resistant identity for UK businesses.
The prompt stops being optional
Between now and February, the passkey nudge behaves like every other Microsoft prompt: it appears, the user snoozes it, and nothing changes. After the retirement date for their group, the snooze disappears for one specific population: users whose only available second factor is SMS or voice. Somebody already enrolled in the Authenticator app alongside SMS keeps signing in as normal.
Microsoft’s FAQ on the retirement answers the question people keep asking, which is whether staff get locked out. The answer is no. What happens instead is that users who still rely on SMS or voice ‘will receive a blocking registration prompt to register a passkey’, can no longer skip it, and ‘will need to complete passkey registration before they can continue to sign in’.
The practical difference is smaller than it sounds. A finance manager who reaches that prompt on a Monday morning, on a device that cannot create a passkey, is not signing in either way. Which devices can create one is a fleet question before it is an identity question, and a practical Intune setup walks through that half. Our view is that the businesses most likely to run into problems are those that have not identified which staff still rely on SMS. With users able to snooze the registration prompt for months, it is easy for that dependency to go unnoticed until the deadline arrives.
Two scoping points are worth having before you plan anything. Self-service password reset is inside the retirement, so an SMS reset route disappears with it. And external multi-factor methods are outside it, unless those users are also enabled for SMS or voice.
Global administrators get five more months, internal guests do not
The July date for administrators reads like a concession and behaves like a trap. Your most privileged accounts keep a weak factor for an extra five months, and the accounts you are least likely to have inventoried lose theirs first.
One timing detail deserves attention. Microsoft says passkey support for B2B users and internal guest users should become available by the end of 2026. Those same internal guest users then face the SMS and voice retirement deadline in February 2027. On our reading that leaves a narrow window between support arriving and the deadline arriving, and it is the part of this timeline we would watch instead of assuming.
Microsoft publishes a PowerShell script for listing every user enabled for SMS or voice, and its own FAQ is blunt about how to read the output: any non-zero result means you are in scope. Read that number for what it is. It counts everyone who still has SMS or voice enabled. That shows everyone affected by the retirement, but not the smaller group who will hit the blocking sign-in prompt because SMS or voice is their only authentication method. Splitting the first number into the second is the work.
Keeping SMS is possible, and it now costs money
Businesses with a regulatory reason to keep a text-message channel have a route, and it has its own calendar. Microsoft is moving SMS and voice delivery to customer-managed telecom providers contracted through the Microsoft Security Store. Provider options and terms were published on 18 September 2026, and configuration opens on 30 October 2026.
Three things follow from that, and the third is the one that changes budgets.
First, configuring a provider before the retirement date removes the blocking prompt entirely for the users you migrate. Microsoft confirms this in the FAQ.
Second, the route exists for a stated reason. Microsoft frames it around a valid business, regulatory or operational need, so it is worth documenting which regulation or scenario applies before you start.
Third, it is chargeable. Pricing varies by provider and region, is typically per-message, and depends on volume and geography. Microsoft charges nothing for moving users to passkeys instead, though any device that cannot create one still has to be replaced or reconfigured. Our view, and Microsoft does not say this, is that for most businesses under a hundred staff that comparison settles the question on its own.
Businesses can temporarily opt out between September 2026 and February 2027 through the authentication methods policy. This delays the registration nudge and gives you more time to prepare. It expires on its own. Microsoft is explicit that standard enforcement applies from February regardless of the setting, and that there is no opt-out from enforcement for any tenant.
Shared and secondary accounts are worth checking too. They are often the accounts that sit outside normal onboarding and device-management processes, which makes them easier to miss when authentication methods change. If they still depend on SMS or voice, they need to be included in the same review rather than assumed to be covered by somebody else’s sign-in method.
What to do between now and February
Five steps clear most of the ground, and the first one is worth doing this month.
- A non-zero result puts you in scope.
- Split that list into regular users, internal guests and global administrators, because they face two different dates.
- Decide, for any regulated exception, whether you need a customer-managed provider. Configuration opens on 30 October 2026, making this the most immediate decision businesses need to make.
- Check which devices in the business can create a passkey, and replace or reconfigure the ones that cannot.
- Tell people before the prompt does. Microsoft’s own guidance is that coordinated communication is the single biggest predictor of a smooth rollout.
Two exclusions save wasted effort. This timeline covers public cloud environments only, with other environments to follow on a later schedule. Azure AD B2C is out of scope altogether.
Nothing here is difficult. It is a list, a decision and a short communications exercise, and the cost of skipping it is a Monday morning where somebody on your finance team cannot open their mail.
This is also a good opportunity to review how you manage authentication methods across the wider tenant. If SMS became the default simply because it was the easiest option at the time, the retirement gives businesses a reason to introduce stronger methods, remove outdated settings and make sure new starters use the right authentication method from day one.
We manage Microsoft 365 tenants for businesses across the North East, and our Microsoft 365 configuration and security management service covers tenant setup, migration, single sign-on and ongoing support. If you want the in-scope number for your own tenant before you plan anything, that is the first thing we would run.