The way people log in to their accounts is changing again, and this time the shift is coming from one of the biggest names in technology. Microsoft has announced that it is moving users who currently rely on text message or phone call codes over to passkeys, and it plans to retire its own text and voice code delivery over time. If your business uses Microsoft accounts for email, file storage, or any of its other services, this change will eventually reach your team.
This is not a small update buried in a settings menu. It is a fundamental shift in how identity is verified online, and it reflects a broader move across the tech industry away from codes and passwords toward device-based authentication. Here is what business owners need to understand about why this matters and how to prepare.
Why Text and Voice Codes Are Being Phased Out
For years, receiving a one-time code by text message or automated phone call has been a standard second layer of security, commonly known as multi-factor authentication. It was a major improvement over relying on passwords alone. But it has a well-documented weakness: those codes can be intercepted.
Attackers have developed several reliable ways to get around SMS and voice codes, including:
- Convincing phone calls where someone poses as IT support or a bank representative and talks a person into reading back their code
- Phishing messages that direct users to fake login pages designed to capture codes in real time
- SIM swapping, where an attacker tricks a mobile carrier into transferring a phone number to a device they control
These methods do not require advanced technical skill. They rely on convincing a person to hand over information voluntarily, which makes them effective against even well-meaning, careful employees. That is exactly the gap passkeys are designed to close.
What Makes Passkeys Different
A passkey is not a code you read, type, or repeat to anyone. It is a cryptographic credential that lives on your device, such as a phone, laptop, or security key. When you log in, your device confirms your identity using something like a fingerprint, face scan, or device PIN, and that confirmation talks directly to the account service. Nothing gets transmitted that a scammer could trick someone into revealing over the phone or through a fake text.
Because a passkey never leaves the device it is tied to, it cannot be phished, intercepted, or socially engineered the same way a text code can. This is a meaningful upgrade in security, not just a change in login steps for the sake of change.
What This Means for Business Owners
If your organization uses Microsoft 365, Outlook, or any Microsoft-connected service, expect to see prompts encouraging or requiring a switch to passkeys in the coming months. The practical advice here is simple: do not brush off the prompt when it appears, and do not let your team brush it off either.
In our experience working with businesses through login and security changes, resistance tends to come from a predictable place. Some staff, and often the busiest leaders in the company, are the most likely to skip the update, delay it, or ask someone else to handle it later. Ironically, these are frequently the accounts attackers target first, since leadership often has the broadest access to sensitive systems and financial tools.
That resistance is exactly where security gaps linger the longest. An account still relying on outdated SMS codes while the rest of the organization has moved to passkeys becomes the easiest target in the building.
How to Get Ahead of the Change
You do not need to wait for Microsoft to force the transition. Consider taking these steps now:
- Identify which staff members and accounts still rely on text or voice codes for login
- Set up passkeys on company devices before the deadline pressure hits
- Walk key leadership and decision-makers through the setup personally, since they are the most likely to delay
- Confirm that backup access methods are in place in case a device is lost or replaced
Handled proactively, this transition takes very little time. Handled reactively, it can turn into a scramble during a period when Microsoft is actively phasing out the old method.
The Bigger Picture
This change from Microsoft is part of a larger industry trend. Google, Apple, and major password managers have all been pushing toward passkeys for the same reason: text and voice codes were a helpful step forward when they were introduced, but they are no longer enough on their own to stop determined attackers.
For business owners, the goal is not to memorize every technical detail of how passkeys work. It is to know that the change is coming, take it seriously when it reaches your team, and make sure the accounts with the most access are not the ones left behind.
Run Networks follows these login and authentication changes closely so businesses do not have to sort through the technical details on their own. If you want help preparing your team for the shift to passkeys, or reviewing which accounts still rely on outdated login methods, we are glad to help you move forward without the guesswork.
