SMS and voice call authentication will be disabled for Microsoft 365 sign-ins in February 2027

Authentication using text messages (SMS) or voice calls will be discontinued. Going forward, you can sign in securely using Microsoft Authenticator, a passkey, or a physical security key.

Microsoft is strengthening the security of its multi-factor authentication (MFA) methods. SMS and voice call authentication will be phased out and replaced with more phishing-resistant authentication methods.

The available options are:

  1. A passkey stored in Microsoft Authenticator. See Microsoft’s instructions for setting up a passkey.
  2. A physical FIDO2 security key (passkey).
  3. The Microsoft’s Authenticator app (or a third-party authenticator app such as Google Authenticator or Authy). After adding your Microsoft 365 account to an authenticator app, you will receive a one-time verification code when signing in.

A passkey is the recommended option. It is a secure digital credential stored on your phone, computer, or a physical security key connected via USB. It allows you to verify your identity using your fingerprint, facial recognition, or device PIN, without needing a verification code sent by SMS.

Why is this change being made?

SMS messages and voice calls are more vulnerable to attacks such as SIM swapping and phishing. Modern authentication methods provide significantly stronger protection because they are much more difficult for attackers to intercept, steal, or misuse.

Schedule

1 September 2026 Microsoft will begin prompting users who still use SMS or voice call authentication to register a passkey if one has not already been configured for their account.

1 February 2027 SMS and voice call authentication provided by Microsoft will be fully disabled. After this date, users whose only MFA method is SMS or voice call will no longer be able to sign in until they register another authentication method.

What do you need to do?

f you have not already set up a passkey (either in Microsoft Authenticator or on a physical security key) or configured the Authenticator app, please do so well before the old authentication methods are retired. Instructions are available above in this announcement.

  • Do not remove your existing authentication methods until you have confirmed that the new method works correctly.
  • f you are prompted to register a passkey or another strong authentication method when signing in, follow the on-screen instructions.

Need help?

If you are unable to set up a new authentication method or are unsure whether this change affects you, please contact ICT Services at ict@oulu.fi.




Created 18.8.2026 | Updated 18.8.2026