Microsoft is gradually phasing out the use of SMS and phone calls for two-step verification for Microsoft 365 work and school accounts. Do you use one of these methods to sign in? Set up another verification method in time to keep access to your account.
Want to know more about managing two-step verification?
Read our guide on setting up two-step verification for Microsoft 365.
When will SMS and phone calls be phased out?
Microsoft is introducing the change in several phases:
- Since 1 September 2026, users for whom SMS or phone calls are available as a verification method are gradually being prompted to register a passkey.
- From 1 February 2027, Microsoft will stop sending verification codes by SMS and offering phone verification for most users.
- From 1 July 2027, this will also stop for Global Administrators and external users.
Anyone still using only SMS or phone calls by the applicable deadline may experience problems signing in. So do not wait until the last day to switch.
How do you prepare your organisation?
These actions will help you support users in switching in time:
- Identify which users currently use SMS or phone calls for two-step verification.
- Ask them to set up another verification method. Preferably choose a phishing-resistant method, such as a passkey in Microsoft Authenticator or a FIDO2 security key.
- In particular, check the accounts with the Global Administrator role. Make sure these administrators always have a working alternative verification method.
- Inform users in advance about the change, the deadline and the method they need to set up. Remind users who have not yet switched to do so in time.
Ask users to test their new verification method before removing their existing method. This will prevent them from losing access to their account.
Can you keep using SMS or phone calls?
Does your organisation have a specific reason to keep using SMS or phone calls? Microsoft provides the option to connect your own telephony provider through Microsoft Security Store.
This does not happen automatically. Your organisation must choose and configure the provider itself before the applicable deadline. For other users, switching to a phishing-resistant method remains the recommended choice.