Microsoft is starting to phase out SMS text messages as a method of authentication and account recovery for personal Microsoft accounts, directing users toward passkeys, the Microsoft Authenticator app, and verified email instead. The change applies to both sign-in and account recovery, and Microsoft has not published a specific cutoff date, saying it will begin prompting users to switch to other methods.
Microsoft describes SMS as a leading source of fraud and points to phishing and SIM-swap attacks as weaknesses of text-message codes. The company positions passkeys as the primary replacement, describing them as “a modern, phishing-resistant way to sign in using your device’s built-in authentication (like Face ID, fingerprint, or PIN).” For account recovery, Microsoft recommends pairing a passkey with a verified email address so users are not locked out when they change phone numbers or lose a device.
The framing ties the change to biometrics on the user’s device. A passkey created on a phone or PC is unlocked with the same gesture that unlocks the device, such as Windows Hello facial recognition, a fingerprint sensor, or a local device PIN, rather than a code sent over the mobile network. The credential itself is bound to the device and validated without a shared secret transmitted by text.
Microsoft’s support materials indicate that users who currently rely only on SMS will be prompted to add another method, and that a verified email address serves as a recovery fallback so account access is preserved when a phone number changes or a device is lost. The passkey itself is created and stored on the user’s device and validated locally with the device unlock gesture, while the Microsoft Authenticator app can also approve sign-ins, giving users more than one passwordless path as text-message codes are withdrawn.
The move continues a multi-year passwordless push. Microsoft has already made passwordless the default for newly created accounts, added native passkey support to Microsoft Authenticator, and expanded passkey support across account recovery. Reducing reliance on SMS removes one of the remaining password-era fallbacks for consumer accounts.
The policy as described applies to personal Microsoft accounts, the consumer accounts used for services such as Outlook.com, Xbox, and Microsoft 365 subscriptions. Microsoft’s published materials on the SMS change do not address whether work or school accounts managed through enterprise identity systems are affected, and those accounts are governed by separate administrator-controlled policies.
Sources: Microsoft Support, Windows Latest
–
By the ID Tech Editorial Team
