Microsoft Replaces SMS Codes With Passkeys for Personal Accounts

Microsoft said it is phasing out SMS-based authentication and account recovery for personal Microsoft accounts, citing fraud, phishing, SIM-swapping, and delivery delays as key reasons for the change. Updated support guidance says users will be moved toward passwordless sign-in with passkeys and verified secondary email addresses, reflecting a broader industry retreat from SMS as a security control.

The company has begun rolling out a redesigned sign-in experience that encourages users to choose a "sign in faster" option and create a passkey backed by device biometrics or a PIN. Microsoft said passkeys can be stored on devices, in password managers, or through Windows Hello-compatible hardware across Windows 11, Android, iOS, and macOS, but it has not given a final cutoff date for SMS, meaning users who still rely on texted codes will need to set up a passkey or verified backup email before the transition is completed.