For a while now, it’s been possible to authenticate your Microsoft account logins by receiving a six-digit code via text message. Windows Latest now reports that SMS verification will be phased out shortly.
It looks like Microsoft wants users who still rely on SMS verification to switch over to passkeys instead going forward. This doesn’t come as a surprise, though, given that Microsoft started forcing passkeys for new Microsoft accounts a year ago.
Unlike a password, which is just a single set of characters that can be stolen or guessed by hackers, a passkey is actually a pair of two unique keys: one key stored on your device and guarded by biometrics (i.e., facial recognition, fingerprints, or PIN codes), the other key held by the website, app, or service for which you’ve created a user account. Both keys are needed for a successful login.
Switching to passkeys is the smartest move you can make for digital security, especially if you’re still using SMS codes. We’ve previously explained why SMS authentication codes aren’t secure—Microsoft outright says “SMS-based authentication is now a leading source of fraud”—and how to set up passkeys for Microsoft accounts.
Unfortunately, Microsoft hasn’t given a concrete timeline for the phasing out of SMS authentication other than “soon.” As such, you’ll want to make this a priority and switch as soon as you can.
What if you can’t use passkeys, such as when you’re trying to log into Windows on a virtual machine? As of this writing, there’s no clear answer. Microsoft seems keen on enforcing passkeys and we can only wait and see how it resolves logins for no-passkey cases.
Further reading: I was a passkey skeptic. Now I’m a believer
