Microsoft Is Phasing Out SMS Codes for Personal Accounts
In short
In August 2026, Microsoft said it will start phasing out SMS as a sign-in and recovery method for personal Microsoft accounts, pushing passkeys, verified email and Apple or Google sign-in instead. It has not published a final cutoff date for consumers.
In August 2026, Microsoft published a support notice saying it will start phasing out SMS as a method of authentication and account recovery for personal Microsoft accounts, the kind used for Outlook.com, Xbox and Windows sign-in. Microsoft called SMS-based authentication a leading source of fraud and pointed to phishing and SIM-swap attacks.
Microsoft's recommended replacements are passkeys, which use your device's biometrics or PIN, a verified email address and one-click sign-in with an Apple or Google account. Microsoft says a verified email and a passkey let you get back into your account even after changing phone numbers or losing a device. The notice does not give a date when SMS codes stop entirely, and press reports say SMS still works for now.
Work and school accounts are on a separate, firmer schedule. For Microsoft Entra ID, passkeys were auto-enabled for users set up for SMS or voice starting September 1, 2026. Microsoft-provided SMS and voice authentication retires on February 1, 2027, and on July 1, 2027 for Global Administrators and external users, unless an organization sets up its own telephony provider.
For anyone who verifies a Microsoft account with a phone number, the direction is clear: a phone number is becoming a weak fallback, not the main key. That is especially true for a number you won't keep, such as a single-use number from a service like Noir SMS, which should only be used to verify your own account and then replaced with a passkey and your own email.
What to do
Add a passkey and a verified email to your Microsoft account now so an SMS phase-out can't lock you out.
Sources
Related services
Related guides
How to Move Two-Factor Authentication Off a Temporary Number
Step-by-step: switch an account's sign-in and recovery from a temporary number to an authenticator app, passkey, email or your own number.
Read the guide →Safety & privacyTwo-Factor Authentication Explained: SMS, Authenticator Apps, Passkeys and Security Keys
2FA explained: SMS codes, authenticator apps, passkeys and hardware security keys compared, with clear recommendations for your accounts.
Read the guide →More news
Discord Starts Global Age Assurance for All Accounts
On September 22, 2026, Discord began a global rollout that places every account in an adult, teen or unconfirmed group based mainly on account signals. Discord says more than 90% of users won't be asked to confirm their age manually.
Read →August 25, 2026WhatsApp Adds Multiple Passkeys, Replaces 2FA PIN
On August 25, 2026, WhatsApp said over a billion people now sign in with passkeys, let accounts add more than one passkey, and replaced the six-digit two-step verification PIN with a longer password. None of it is applied automatically.
Read →July 27, 2026UK SIM Farm Ban: Offences Apply From October 29, 2026
The UK's Crime and Policing Act 2026, which received Royal Assent on April 29, 2026, creates offences for possessing or supplying SIM farms without good reason. Home Office guidance published July 27, 2026 says penalties apply from October 29, 2026.
Read →July 15, 2026Ofcom Finalizes Rules to Block UK Scam Texts
On July 15, 2026, Ofcom finalized rules requiring UK mobile operators to block scam numbers and messages and limit how many texts pay-as-you-go SIMs can send, plus checks on business senders and sender IDs. They take effect in January and July 2027.
Read →