Microsoft is telling Entra ID administrators to prepare for a change in how people sign in. According to the report, SMS and voice authentication are set to be retired in February 2027, and organizations are being encouraged to move toward passkeys and other phishing-resistant sign-in methods.
This is not a scam report. It is a reminder about a planned login change. Still, changes like this can create confusion, and scammers often use confusion to their advantage. That is why it helps to understand what real account notices look like and how to check them safely.
What this means
If your organization uses Entra ID, some older phone-based sign-in methods may stop working in the future. That does not mean your account is in danger right now. It does mean your workplace or school may need to update the way people log in before the deadline.
Passkeys are designed to be harder to phish than codes sent by text or voice. They are part of a broader move toward stronger sign-in methods.
For regular users, the main lesson is simple: account changes should come through clear, official channels. If a message says your login method is changing, pause and check that it really came from your organization.
Warning signs
Be careful if you see:
- A message that says you must act immediately, especially if it creates panic
- A request to change sign-in settings through a link you were not expecting
- An email or text that looks official but gives little detail about the organization or account
- A warning that older login methods have expired, but you cannot confirm it anywhere else
- A prompt to share a code, approve a login, or enter credentials on a page you did not open yourself
These signs do not prove a scam on their own. But they are reasons to slow down and verify.
Questions to ask
Before you click, sign in, or change anything, ask:
- Did this notice come from my organization’s normal support channel?
- Is there a matching announcement on the company intranet, help desk page, or official Microsoft admin message?
- Am I being asked to use a login method my organization has already approved?
- Is this message giving a deadline that matches the known February 2027 change?
- If I am unsure, who can I contact through a trusted phone number or internal directory?
Simple questions can prevent rushed mistakes.
Safer next steps
Here are safer habits if you get a message about sign-in changes:
- Do not use links in a message unless you were already expecting the update
- Go directly to the official sign-in page or your organization’s help desk site
- Use only login methods your organization says are approved
- Save a copy of the message so you can compare it with official notices
- Ask a trusted coworker, manager, or IT contact to confirm the change
If your workplace or school is planning a switch to passkeys, it is better to prepare early than wait until the last minute.
Ways to verify
You cannot assume a message is real just because it mentions Microsoft or a familiar service. To check it safely:
- Look for the same notice in an official Microsoft admin message or your organization’s own announcement
- Visit the official Microsoft help and admin pages by typing the address yourself
- Contact your IT team using a number or email address you already trust
- Compare the sender address and message style with past official notices
- If you manage accounts, confirm whether your organization has already started moving users to passkeys
Official verification is the safest path. If the message is genuine, a trusted channel should confirm it.
Final reminder
Planned changes to sign-in methods can be easy to confuse with scam messages. Take your time, check the source, and use trusted channels before you act. No tool can confirm a message with certainty from one screen alone, so a second check is always smart.
Source note: Based on BleepingComputer’s report, “Microsoft reminds Entra ID admins to migrate users to passkeys.” Original source: https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys/