Microsoft Starts Switching Off the Text Message Code Today. It Blames the Price of a Phishing Email.

The code was correct, current, and completely worthless

A finance manager gets an email about a shared document, clicks through to a Microsoft sign-in page that looks exactly right, and types her password. A text message arrives with a six digit code. It is a real code, generated by the real Microsoft, for a login happening at that moment. She types it in. The page she typed it into belonged to somebody else, who passed both the password and the code straight through to the genuine site and walked away with her session.

Nothing in that sequence was a mistake she could have caught by paying closer attention. From today, 1 September 2026, Microsoft has begun taking the option away.

What Microsoft is doing, and when

Microsoft Entra ID, the identity service holding the corporate logins for a large share of the world's enterprises, starts rolling out passkeys as its default authentication experience today. Users currently enabled for SMS or voice are automatically enabled for passkeys and prompted to register one the next time they complete multi-factor authentication (MFA, the second step after the password). Those prompts can be snoozed without limit by default, so nobody loses access this week. The hard date is 1 February 2027, when Microsoft retires its own SMS and voice delivery. After that, a user whose only second factor is a phone number meets a prompt that blocks the sign-in until a passkey is registered, and Microsoft's documentation states flatly that there is no opt-out and that it applies to every tenant. Nadim Abdo, the corporate vice president who runs identity engineering, announced the change on 13 July 2026. It covers the public cloud only for now.

The attack in the opening has a name, adversary in the middle, and understanding it explains the whole decision. The attacker runs a proxy that sits between the victim and the real login page, relaying every field in real time. A one-time code is a shared secret, a number that means something only because both ends know it, sent over a channel and then retyped by a human into whichever page asked for it. Nothing about the code is tied to the page requesting it, so passing it along costs the attacker nothing. A passkey inverts that. The private half of a cryptographic key pair is created on the device and never leaves it, and the browser will only offer that key to the exact domain that created it. On a lookalike domain the browser holds no key for that address and hands over nothing at all. The user did not become harder to fool. The judgement simply moved from a person reading a URL in a hurry to software comparing two strings, and software is not persuaded by a well-written email.

• Microsoft Threat Intelligence reports AI-assisted phishing campaigns reaching click-through rates of 54 percent, against roughly 12 percent for conventional ones. That figure comes from Microsoft's own telemetry, published in its 2025 Digital Defense Report.
• Independent work points the same direction with more modest numbers. A field experiment with 7,741 participants, presented at the USENIX Security Symposium in 2026 by researchers from TU Berlin, Inria and Ruhr University Bochum, found personalised AI-written phishing achieved 2.4 times the click rate of generic phishing, at a cost of roughly three cents per message.
• Organisations with a genuine regulatory need for SMS can contract a third-party carrier through the Microsoft Security Store from 30 October 2026, with the provider list due on 18 September. The telecom bill becomes the customer's.

Why it matters

The immediate consequence is a five month deadline with a hard edge, and the awkward part is who it lands on. The population still sitting on SMS in most tenants is not head office. It is the contractors, the frontline staff with no managed phone, the shared operational accounts and the break-glass administrator logins, which is to say exactly the accounts nobody migrated because migrating them was fiddly. Microsoft publishes a PowerShell script for finding them, and running it this month rather than in January is the difference between a project and an incident. Check one more thing while you are in there. If your account recovery path falls back to a phone call to the service desk, you have relocated the phishable step rather than removed it, because a cloned voice on that call now costs almost nothing to produce.

The wider shift is worth raising at your next architecture review. A hyperscaler is withdrawing a security control from billions of users, not because somebody found a new flaw in it, but because producing the convincing lure that defeats it now costs about three cents. Security awareness training was built on the assumption that attacker attention was scarce, that a personalised, fluent, well-researched message aimed at one accountant was too expensive to bother with. That assumption is the thing actually being retired here. SMS is just the first control standing on top of it.

What to do about it

1. Run the SMS and voice inventory this week, before planning anything else. Microsoft ships a script for it, and the result usually surfaces service accounts and contractors that appear in no migration plan, which is why the number is more useful in September than in January.
2. Turn on the passkey registration campaign yourself rather than letting the default do it. Driving registration while snoozing is still permitted spreads the help desk load across five months instead of concentrating it in the week the prompt turns blocking.
3. Fix account recovery before you fix authentication. A phishing-resistant login with a phone-based reset behind it is only as strong as the reset, and voice cloning has made the call to the service desk the cheapest remaining way in.

Bottom line

The date to write down is 1 February 2027, but the question to raise sooner is broader than passkeys. Every control your organisation runs that depends on a person noticing something looks wrong was priced against an attacker who had to write the lure by hand. At three cents a message that pricing is gone, and the phishing email is merely the most visible thing it used to pay for. Microsoft has now told you which of its own controls did not survive the repricing. The useful exercise is listing yours.