Skip to main content
Sign in

Microsoft Multi-Factor Authentication

Tristan Rodeback
  • Updated

No More Text or Voice Multi-Factor Authentication

Microsoft is changing two-factor authentication methods beginning September 1, 2026. This is a mandatory shift to stronger authentication methods that better protect users from phishing, credential theft, and social engineering attacks. Authentication methods that use SMS text messages or voice calls rely on communication channels that attackers can increasingly intercept, phish, or manipulate.

What this means is that beginning September 1, 2026, all District staff members will no longer be able to register a phone number as a two-factor authentication method. As Microsoft rolls out this change to organizations, users currently enabled for SMS or voice authentication will automatically be prompted to enroll a passkey the next time they complete multifactor authentication. Microsoft is rolling this out gradually across all tenants, so the change may not occur on September 1st for our organization specifically.

Following this transition, on February 1, 2027, Microsoft will retire Microsoft-provided telecom delivery for SMS and voice authentication and will no longer offer either authentication method. After this date, even if a phone number remains registered, it will no longer function as a multifactor authentication method.

What Can I Use Moving Forward?

Microsoft strongly encourages the use of passkeys, although other supported authentication methods will remain available.

Passkeys are phishing-resistant credentials that provide strong authentication and can serve as a multifactor authentication method when combined with device biometrics or a PIN. Unlike passwords, passkeys use cryptographic keys that are tied to a specific device or provider and cannot be reused by attackers on a malicious website.

You may setup any of these methods right now via the Microsoft My Account portal in My Account > Security info. https://mysignins.microsoft.com/security-info

Otherwise, all users will be prompted to setup one of the following methods starting Sept 1st, or forced to setup another method starting Feb 1st as mentioned above. 

Option 1: Passkey in Microsoft Authenticator (Microsoft Recommended)

A passkey can be stored in the Microsoft Authenticator app and used to sign in without entering a password.

Requirements for iPhone Users

  • iPhone running iOS 17 or later. 
  • Microsoft Authenticator installed. Appstore Link
  • Face ID, Touch ID, or a device passcode configured. 
  • Internet connectivity (Wi-Fi or cellular data).

Requirements for Android Users

  • Android device running Android 14 or later. 
  • Microsoft Authenticator installed. Playstore Link
  • Fingerprint, Face Unlock, or a device PIN configured. 
  • Internet connectivity (Wi-Fi or cellular data).

Option 2: Passkey in Apple Passwords (iCloud Keychain)

Users may store a passkey in Apple's Passwords application (formerly iCloud Keychain).

Requirements

  • Apple ID signed into the device.
  • iCloud Keychain enabled.
  • iPhone running iOS 16 or later.
  • Face ID, Touch ID, or a device passcode configured.
  • Internet connectivity (Wi-Fi or cellular data).

Option 3: Passkey in Google Password Manager

Users may store a passkey in Google Password Manager on supported Android devices.

Requirements

  • Android device running 14+ OS. 
  • Google account signed into the device. 
  • Google Play Services installed and functioning. 
  • Google Password Manager available and enabled. 
  • Fingerprint, Face Unlock, PIN, or Password configured on the device.
  • Internet connectivity (Wi-Fi or cellular data).

Option 4: Microsoft Authenticator Notification (Push Approval)

Users can use the Microsoft Authenticator app installed on an Android/Apple device without creating a passkey.

You simply approve the sign-in request using the app. You may be asked to enter a matching number displayed on the sign-in screen before approving the request.

Requirements

  • Microsoft Authenticator installed on a smartphone (iOS 16+ or Android 8.0+).
  • Face ID, Touch ID, or a device passcode configured.
  • Internet connectivity (Wi-Fi or cellular data if using the push notifications). 
Who Should Use This Option?

This option is recommended for users whose devices do not meet the requirements for passkeys.

 

Option 5: Software OATH Token (Authenticator Code)

A 6-digit rotating token generated by an authenticator application. This method requires Wi-Fi or cellular data to setup, but once setup does not require an internet connection for use. 

Some supported applications include:

  • Microsoft Authenticator
  • Google Authenticator
  • Authy
  • 1Password
  • Bitwarden Authenticator
  • Keeper Password Manager
  • LastPass Authenticator
  • 2FAS Authenticator

This method generates a six-digit code that changes every 30 seconds and can be entered during sign-in. While software OATH tokens remain significantly more secure than SMS or voice authentication, Microsoft recommends passkeys whenever possible because passkeys provide phishing-resistant authentication and a simpler sign-in experience. Using this method users may see "Setup a Passkey" every time they login and have to skip that prompt. 

Also, setting up Option 4 with the Microsoft Authenticator creates an OATH Token (Option 5) in the app that can be used in case Internet connectivity is not available. So for this reason it is recommended to install the Authenticator App if a passkey cannot be created on a device. 

Related articles

Comments

0 comments

Please sign in to leave a comment.