Microsoft Is Ending SMS Authentication: What This Means for Your Business

For years, the standard approach to securing a Microsoft 365 login was a password plus a six-digit SMS code sent to a mobile number. It was better than a password alone — but not by as much as most people assumed. Microsoft is retiring its own SMS and voice delivery in Entra ID and encouraging passkeys: phishing-resistant credentials that avoid one-time codes.

The September rollout has already begun. Identify which retirement group each user belongs to and test replacement sign-in methods before their applicable deadline.

Why SMS authentication is being retired

SMS was never designed as a security mechanism. Text messages can be intercepted through SIM-swapping — where an attacker convinces a mobile operator to transfer your number to their SIM card — or through SS7 protocol vulnerabilities, which allow sophisticated attackers to reroute messages in transit. Both attack types have been used against business accounts in South Africa.

Beyond interception, SMS codes are still vulnerable to phishing. A convincing fake login page can capture both your password and the SMS code in real time, because the attacker can relay them to the real site before the code expires. Passkeys break this attack entirely.

What is a passkey?

A passkey uses cryptographic keys to prove your identity without typing a one-time code. Device-bound passkeys stay on their device; synced passkeys are held in a supported credential manager and can sync across your devices. Sign-in is tied to the legitimate service, which resists phishing.

Common phishing-resistant sign-in options include:

What changes — and when

The dates below concern Microsoft-provided SMS and voice delivery in Microsoft Entra ID, the identity platform behind Microsoft 365 sign-ins.

What your business needs to do

The transition is manageable with the right preparation. The key actions are:

1. 1

   Deploy Microsoft Authenticator to all staff

   The Authenticator app is the simplest path to passkeys for most users. It is free, available on iOS and Android, and can store a passkey that works with Face ID or fingerprint. Register and test passkeys now, before each user's applicable retirement date. Installing the app alone does not register a passkey.

2. 2

   Enable Windows Hello for Business

   For staff on Windows devices, Windows Hello for Business uses a PIN or biometric to authenticate without any phone at all. Use it where each person signs in with their own Windows account; assess portable passkeys or security keys for shared devices.

3. 3

   Review your Conditional Access policies

   Passkey registration is subject to Conditional Access in Entra ID. Your policies may need adjusting to ensure registration flows work correctly — particularly for remote or off-site staff who cannot access your network during the transition.

4. 4

   Identify SMS-dependent users and their retirement group

   Review authentication methods and sign-in activity in Entra ID. Separate the February and July groups, then confirm each user has a tested replacement method or has migrated to a supported telephony provider.

How StormDotCom is managing this for our clients

We proactively manage and monitor Microsoft 365 tenants for our clients, which means this transition is already in our scope. We use Augmentt — a dedicated Microsoft 365 management platform — to monitor authentication method usage across all our client tenants, identify users still relying on SMS, and track Secure Score changes as passkey adoption improves security posture.

For clients on our managed service, we coordinate registration, device checks and user readiness against the applicable retirement dates. If you are not on a managed plan and want to confirm your environment is ready, the best first step is a Microsoft 365 health review.