Most of us know multi-factor authentication (MFA) adds a second check when you sign in. A password, then a text message or an approval on your phone.
That's much safer than a password alone. But not all MFA gives the same protection, and Microsoft is now acting on that.
From 1 February 2027, Microsoft will stop sending SMS and voice sign-in codes for Microsoft 365 accounts. Businesses that still want them will need to pay a third-party phone provider. Microsoft calls these methods among the most vulnerable available today.
Weakest: text message and phone call codes
These rely on your mobile number. An attacker who takes over your number through a SIM swap gets your codes. A fake sign-in page can also capture a code as you type it.
Better: an authenticator app
Approvals and codes in an app like Microsoft Authenticator aren't tied to your phone number, so a SIM swap won't work. Microsoft also makes you type the number shown on the sign-in screen before you can approve, so tapping Approve by mistake is far less likely. But these methods still aren't phishing-resistant. A convincing fake sign-in page can pass your approval or code to the attacker in real time.
Strongest: phishing-resistant sign-in
Passkeys, security keys and Windows Hello for Business. Each sign-in is locked to the real website and needs you to be at your own device. There's no code to type, so there's nothing to steal or hand over.
How to protect yourself:
• Never approve a sign-in you didn't start
• Don't enter a code on a page opened from an unexpected email
• If prompts keep appearing, tap Deny and contact your IT provider
• Move to a passkey where you can
MFA is still essential. But the question is no longer "Do we have MFA?"
It's "Are we using the right MFA?"
Not sure what your business is using? Send us a message and we'll check your Microsoft 365 setup before the deadline.