If your business runs on Microsoft 365, there's a good chance someone on your team has seen a new screen at sign-in lately, asking them to set up something called a passkey. Most people click "not now" and get on with their day. That will only work for a little while longer.
The prompt is the first visible piece of a change Microsoft has put firm dates on. Passkeys became the default way to sign in to Microsoft's business accounts on September 1, 2026, and on February 1, 2027, Microsoft will stop sending the text-message and phone-call codes that many small businesses still use as their second step. So, this is a good moment to explain what a passkey is, why the biggest names in technology are all pushing it, and what a company your size should do before the deadline arrives.
What a Passkey Is, in Plain Terms
A password is something you know, whether you memorize it, write it down, or have it saved in a password manager. And giving up your passwords, typically by typing them into the wrong place, is the single largest risk that leads to the most account compromises.
A passkey is a key your device holds for you. When you create one, your phone or computer generates a matched pair of keys. One half goes to the service you're signing in to. The other half stays on your device and never leaves it. From then on, signing in works like this: the service sends your device a challenge, you unlock the device the way you always do, with your face, your fingerprint or a PIN, and the device answers the challenge with its half of the key.
There are two key details with passkeys. First, there is nothing to remember, type or reuse, which means there is nothing for an employee to hand over by mistake. Second, your fingerprint or face scan stays on the device. The FIDO Alliance, the industry group behind the standard, is explicit that biometric information is never sent to the service. The service only learns that the check has passed.
Day to day, signing in with a passkey feels just like unlocking your phone. That is the beauty of it.
Why Text-Message Codes Stopped Being Enough
Multi-factor authentication was a real upgrade, and a text-message code is still far better than a password alone. The trouble is that attackers have adapted to it.
Here is how a modern phishing attack gets past a code. An employee receives a convincing email and lands on a fake Microsoft sign-in page. They type their password, and the fake page quietly passes it to the real Microsoft site. Microsoft sends the employee a genuine code. The employee types that code into the fake page too, and the attacker passes it along within seconds. The code was real. It just went through the wrong hands on the way. This is how a large percentage of business email compromise cases begin: with one mailbox taken over while every security box appeared to be ticked.
Text messages have a second problem. A code is only six digits, and six digits are easy to pass along. If you have ever had a call or a text from someone claiming to be your bank and asking you to read back the code you were just sent, you have seen how it works: the attacker already has the password and only needs you to hand over the last piece. Microsoft's own documentation now describes text and voice codes as "among the most vulnerable authentication methods available today."
A passkey closes both gaps. It is tied to the real web address of the service it was created for. If an employee lands on a lookalike page, their device has no key for that address and has nothing to offer. The employee doesn't have to spot the fake, because the device won't cooperate with it. That property is what the industry means by "phishing-resistant," and it is why the federal standards body NIST allows synced passkeys for multi-factor sign-in in its current digital identity guidelines, provided the syncing service meets its security requirements.
This Is Already Mainstream
Passkeys may sound like one more new thing to learn. In practice, most of your team likely already has them set up. The FIDO Alliance estimated in May 2026 that 5 billion passkeys are in use worldwide, and its survey of 11,000 consumers found that 75% had turned one on for at least one account.
They also work better than what they replace. In the FIDO Alliance's Passkey Index, published in October 2026, companies that shared their sign-in data saw passkey sign-ins succeed 93% of the time, against 78% for traditional multi-factor sign-ins, and save people an average of 27 seconds each time. For a business, that adds up to fewer failed sign-ins, fewer lockouts, and fewer calls to whoever handles your IT.
What Microsoft Is Changing, and When
So, if your company uses Microsoft 365, here are three dates you should be aware of:
September 1, 2026. Passkeys became the default sign-in method. Anyone set up for text or call codes was automatically made eligible for a passkey and started seeing a prompt to create one after signing in. For now, that prompt can be snoozed.
February 1, 2027. Microsoft stops providing text-message and phone-call codes for most users. Anyone whose only second step is a text or a call will have to set up a passkey before they can finish signing in. There is no way to opt out of this step.
July 1, 2027. The same change reaches Global Administrator accounts and external users.
Here are a few clarifications that will save you some worry.
1. Authenticator app codes are not part of this retirement and will keep working, although they are not as secure. If you are currently using an authenticator app, it is still recommended that you set up a passkey.
2. Microsoft will not lock you out when the text/phone codes are retired. What will happen is that you will get a passkey setup screen that you are no longer able to skip.
Companies with a genuine need for text or call codes can keep them by contracting with an outside phone provider through Microsoft, at their own cost. Passkeys themselves come at no additional charge.
Synced or Device-Bound: The Decision That Matters
Passkeys come in two kinds, and choosing between them is the main decision a business has to make.
Synced passkeys are saved in the password manager built into a phone or computer, such as iCloud Keychain or Google Password Manager. They follow the person to a new phone automatically, which makes them the easy choice for most staff.
Device-bound passkeys live on one device and stay there: a passkey in the Microsoft Authenticator app, one stored on a Windows PC, or a physical security key that plugs into a USB port. They give a business tighter control, and they are the answer for employees who don't carry a company phone.
Microsoft's guidance is to use synced passkeys for regular staff and device-bound passkeys for administrators and anyone with elevated access. The tradeoff is straightforward. Synced passkeys are convenient, but Microsoft acknowledges that an administrator can't currently see which devices hold a copy. Device-bound passkeys stay put, and that means a replaced phone needs a fresh setup.
The Honest Limits
Passkeys are a strong improvement; however, they are only one piece of the puzzle. Here are a few things worth knowing before setting up a passkey and calling it a day.
Old sign-in methods stay behind unless someone removes them. If an account has a passkey and can still be opened with a password and a text code, an attacker will simply use the older route. Removing the old, unsecure methods is a necessary part of the process.
Phones get lost, broken and replaced. With a device-bound passkey, the person needs a second way in or a quick path to IT. Decide what that looks like before the first phone goes missing.
Not everything supports passkeys yet. Older line-of-business software, shared front-desk computers, and warehouse workstations each need their own answer. Make sure to plan these out before deadline day comes.
A passkey protects the sign-in and nothing after it. It won't stop a convincing invoice email or malware on an unpatched laptop. The fundamentals we covered in 5 IT Mistakes Small Businesses Make still apply.
What to Do Before February
None of this is too difficult to set up. It only goes badly when it is left to the last minute. Here is the order we'd work in.
Find out who still relies on text or call codes. Microsoft publishes a tool for this, and whoever manages your Microsoft 365 can run it in a few minutes. In most small businesses the list is longer than the owner expects.
Decide which kind of passkey each group gets. Synced for most staff, device-bound or security keys for administrators, and a specific plan for shared computers.
Start with a handful of people. A short pilot surfaces the odd cases, such as the older phone or the app that refuses to cooperate, while the stakes are low.
Tell your team before the prompt does. A two-paragraph note that explains what the screen is, why it's appearing and who to ask for help prevents most of the confusion. Microsoft's own guidance on this change says that "coordinated communications are the single biggest predictor of a smooth passkey rollout."
Remove the old methods once people have moved. The job is not finished once passkeys are set up. This step is key to real protection.
A Security Upgrade People Like
Most security improvements ask more of your team: another code, another app, another password rule. This one asks less. People sign in faster, they stop waiting on text messages, and a common way attackers get into business email stops working against them.
The dates are set either way. What you get to choose is whether your team makes the move on a schedule you picked, with a heads-up and someone to call, or on Microsoft's schedule, one unskippable screen at a time.
Common Questions About Passkeys
What is a passkey?
A passkey is a sign-in credential that your phone, computer or security key holds for you, in place of a password you type. You approve each sign-in the same way you unlock the device: with your face, fingerprint, or PIN. Because a passkey only works on the real website it was created for, a fake sign-in page becomes a non-threat.
Is Microsoft getting rid of text message codes?
For work accounts, yes. Microsoft stops providing text-message and phone-call sign-in codes on February 1, 2027 for most users, and on July 1, 2027 for Global Administrators and external users. After that, anyone whose only second step is a text or a call has to set up a passkey before they can finish signing in. Authenticator app codes will continue working.
What happens if an employee loses the phone that holds their passkey?
It depends on the kind of passkey. A synced passkey is restored when the person signs in to the same Apple or Google account on a new phone. A device-bound passkey, including one in Microsoft Authenticator, exists only on that phone, so an administrator will need to remove the old one and the user sets up a new one on the new device. Make sure to decide the recovery process before anyone needs it.
Want this handled before February?
CNI can check who on your team is affected, set up passkeys, and walk everyone through the change. See how we approach multi-factor authentication.
Sources: Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (dates, opt-out, telephony provider option and user communication); Microsoft Learn: FAQ for SMS and voice retirement (authenticator app codes, no lockout, cost); Microsoft Security Blog, July 13, 2026 (announcement); Microsoft Learn: Passkey FAQs (synced and device-bound guidance); FIDO Alliance, World Passkey Day 2026 (5 billion passkeys; 75% of 11,000 consumers surveyed across ten countries); FIDO Alliance Passkey Index 2026 (93% and 78% sign-in success, 27 seconds saved); NIST SP 800-63B-4, Appendix B: Syncable Authenticators.