Microsoft is changing how business users sign in, with a move towards passkeys and away from Microsoft-provided text message and phone call verification.

If your team uses Microsoft 365, now is a good time to check how these changes affect your business and help people prepare.

What is changing, and when?

The changes apply to Microsoft Entra ID, the identity service used to manage Microsoft 365 work and school accounts.

• From 1 September 2026: Microsoft began automatically enabling passkeys and prompting registration for users enabled for SMS or voice authentication.

• From 1 February 2027: Microsoft-provided SMS and voice authentication retires for most users.
• From 1 July 2027: The retirement extends to Global Administrators and external users.

Your IT team or provider should confirm which users are affected and plan the transition before the relevant deadline.

What is a passkey?

A passkey lets you sign in without entering a password. It uses a digital credential, unlocked with a fingerprint, facial recognition or your device’s PIN.
Passkeys are designed to resist phishing because they are linked to the legitimate service. There is no password for you to type into a convincing imitation website.
Microsoft Authenticator can store a passkey for your work account. This is different from using Authenticator to approve a notification or generate a verification code.
For more background, read our explanation of passwordless logins. https://www.beaming.co.uk/knowledge-base/passwordless-logins-explained/

How do I create a passkey in Microsoft Authenticator?

Check first that Authenticator passkeys are enabled for your account and supported on your phone.

If your work account is already in Authenticator:
1. Open Microsoft Authenticator and select your work account.
2. Tap Create a passkey, if available.
3. Complete the authentication checks.
4. Follow the prompts to configure your screen lock and enable Authenticator as a passkey provider.
5. Confirm that setup has completed successfully.

If the option is missing or setup fails, ask your IT team for help. The steps can vary between devices and your organisation’s settings.

What will signing in look like?

The experience depends on the device, browser and application you use.

When signing in on a computer using a passkey stored on your phone, you may need to select Sign-in options, then Face, fingerprint, PIN or security key, and choose the option to use a phone.
Follow the prompts to scan the displayed QR code with your phone’s camera and confirm the sign-in using your device’s security check.

This cross-device process requires your phone nearby, with Bluetooth and internet access enabled on both devices. Signing in on the phone itself can use a different process without a QR code.
Only complete sign-in requests you have initiated.

What if my phone is lost or replaced?

If your passkey is stored in Authenticator on your phone, you will need that phone to use it. Registering a passkey does not mean every other permitted sign-in method automatically disappears.

Before changing phones or removing an existing method, ask your IT team how account recovery works and which additional sign-in methods your business allows.

Planning this in advance helps prevent avoidable disruption. Read more here https://www.beaming.co.uk/knowledge-base/can-i-still-use-2fa-if-my-phone-is-lost-or-stolen/

Need help preparing your team? Speak to Beaming about your Microsoft 365 sign-in arrangements and the next steps for your business. Lets Talk