Microsoft is improving the security of Microsoft 365 accounts by making passkeys the default way to verify your identity when signing in.
From September 2026, staff will begin seeing prompts to set up a passkey. Microsoft is also retiring its own text message (SMS) and phone call verification service, as these methods are no longer considered secure enough against modern cyber-attacks.
What it means for you
-
You may be asked to set up a passkey the next time you sign in to your Microsoft account.
-
You can initially choose to skip the prompt, but Microsoft will increasingly encourage everyone to use passkeys.
What is a passkey?
A passkey is a more secure way to sign in without relying on a text message code.
Instead of entering a code sent to your phone, you confirm it's you using something you already use to unlock your device, such as:
-
Your fingerprint
-
Face recognition
-
Your device PIN
Passkeys are much harder for criminals to steal or trick you into revealing, making your account significantly more secure.
Dates the changes come into effect
-
1 September 2026 – Microsoft begins prompting users to register a passkey when signing in.
-
28 January 2027 – Microsoft will stop providing SMS and voice authentication. Passkeys become the recommended default method. Anyone not configured by then will experience sign in issues.
For more information, please contact the Service Desk on 01603 475603 or ict@norfolk.gov.uk