At most private colleges and universities, multifactor authentication is no longer new. For many faculty and staff, though, it still means waiting for a code by text message or phone call. Microsoft is changing that. On February 1st, 2027, Microsoft retires its own delivery of text message and voice authentication for Microsoft Entra ID. After that, anyone whose only MFA method is a text or phone call will have to register a passkey before they can continue signing in, unless their institution has set up a third-party provider to keep text and phone codes. Global Administrators and external users follow on July 1st, 2027.
For a campus with part-time staff, adjunct faculty, and people who sign in only a few times a term, the challenge is reaching everyone before that date. Here is what passkeys are, the options Microsoft offers, and how the change works on campus.
Why Microsoft Is Moving Away
Text and phone codes were a big step up from passwords alone, but attackers have learned to get around them.
- Codes can be intercepted or phished: Microsoft notes that these methods rely on shared secrets and channels that attackers increasingly intercept, phish, or manipulate.
- SIM swapping and MFA bypass: Microsoft notes these tactics have become more accessible and repeatable.
- AI-assisted phishing: Microsoft Threat Intelligence reports click-through rates as high as 54% for AI-enabled phishing, compared with roughly 12% for traditional campaigns.
What is a Passkey?
A passkey is a sign-in credential that replaces the code. It is built on the FIDO industry standard and uses a pair of keys. The private key stays with the person, either on their device or encrypted in their passkey manager. The public key is stored with Microsoft Entra. Both keys are needed to sign in. Every sign-in also requires the person to unlock the passkey on their own device with a fingerprint, face, or device PIN.
Passkeys resist phishing because each one works only with the site or app it was created for. It can’t be replayed or shared with an attacker, and it won’t sign in to a look-alike page.
Where a Passkey Can Live
Microsoft Entra supports two kinds of passkeys: device-bound passkeys, which stay on one device (the first three below), and synced passkeys (the last). IT decides which ones each group on campus can use.
- Microsoft Authenticator: a passkey stored in the secure hardware of an iPhone or Android phone. It never leaves that phone. For campuses already moving people to the Authenticator app, the passkey can live in the same app.
- Microsoft Entra passkey on Windows: a passkey stored in the Windows Hello container on a Windows 10 or Windows 11 PC and unlocked with a PIN, fingerprint, or face. The PC doesn’t need to be joined to Entra, so it suits personal and shared computers. Campus-managed PCs typically use Windows Hello for Business instead. Each PC is registered separately.
- FIDO2 security keys: a small physical key that holds a device-bound passkey and can move between computers. Microsoft recommends them for administrators and for shared or older devices.
- Synced passkeys: saved in a credential manager such as iCloud Keychain, Google Password Manager, or a supported password manager, and synced across the person’s devices. With passkey profiles, IT can allow synced passkeys for most faculty and staff while requiring device-bound passkeys for IT administrators and other high-privilege accounts.
In open labs and classrooms, where people sit at a different computer each visit, a passkey that travels with the person works best. That can be a passkey in Microsoft Authenticator, used to sign in on the lab computer through a cross-device sign-in that needs Bluetooth and an internet connection on both devices, or a FIDO2 security key. An Entra passkey on Windows would have to be set up again on every computer.
What Changes and When?
- September 1st, 2026: Microsoft began making passkeys the default sign-in experience in Microsoft Entra ID. Unless an institution used Microsoft’s temporary opt-out, people enabled for text or phone codes were automatically enabled for passkeys and are now prompted to register one after they complete MFA. Until February 1, they can skip the prompt.
- February 1st, 2027: Microsoft-provided text and phone codes end for everyone except Global Administrators and external users. Anyone whose only method is a Microsoft-provided text or phone code must register a passkey during sign-in before they can continue.
- July 1st, 2027: the same change applies to Global Administrators and external users.
For institutions with a business, regulatory, or technical need to keep text or phone codes for some groups, Microsoft offers third-party telephony providers through Microsoft Security Store, currently in private preview. Microsoft recommends passkeys as the primary path for everyone else.
People who already sign in with a passkey, Windows Hello for Business, or another phishing-resistant method can keep using it. Microsoft’s guidance on the change has the full details.
How it Works On Campus
Here is what the move looks like for a part-time staff member in the registrar’s office who has signed in with a text code for years:
- IT finds who is affected. In the Microsoft Entra admin center, the Authentication methods activity report shows which sign-in methods each person has registered. Its Usage tab shows which methods are actually used to sign in. IT looks for people who rely only on a phone number, including part-time and seasonal staff who rarely sign in.
- IT confirms the registration campaign covers that group. Microsoft turned the campaign on September 1st unless the institution opted out, so the staff member is prompted to set up a passkey the next time they sign in and complete MFA. Until February 1st, they can skip the prompt, and it returns at a later sign-in.
- IT communicates in steps, using templates Microsoft provides: a heads-up first, then instructions for each type of device, then a reminder.
- The staff member registers a passkey in Microsoft Authenticator on their phone and unlocks it with a fingerprint, face, or PIN.
- Signing in gets simpler. Instead of waiting for a text, they confirm with a fingerprint or PIN. If a phishing email leads them to a fake sign-in page, the passkey won’t sign in there.
- After February 1st, anyone whose only method is still a Microsoft-provided text or phone code must register a passkey during sign-in before they can continue. That is why reaching rarely seen users early matters most.
Each step handles one part of the move, and together they let a campus replace text and phone codes with stronger, simpler sign-in before the deadline.
How Does ScholarBuys Help?
ScholarBuys works alongside private and independent colleges and universities as an extension of their IT staff. Since 2008, our team has helped campuses choose the Microsoft solutions that fit how they actually operate, and through our partnerships with independent college associations in 14 states, we help each institution use its consortium membership to find the best solution for its needs. Today, more than 325 private colleges and universities partner with ScholarBuys.