Microsoft Phases Out SMS Authentication for All Accounts
Microsoft is phasing out SMS authentication and account recovery for all personal Microsoft accounts, including those used with Xbox, citing it as a leading source of fraud. The change promotes more secure passwordless options like passkeys to counter phishing and SIM-swap attacks while simplifying access.
Instead of receiving texts with a six-digit code to prove identity during sign-in, Microsoft is directing users toward other methods such as passkeys. These allow sign-in using Face ID, fingerprints and PIN numbers. Many people already rely on the Microsoft Authenticator app for their Xbox accounts, and the company indicates this will continue to function as normal.
SMS authentication is vulnerable to phishing and SIM-swap attacks. Microsoft is replacing it with passkeys and verified email for better protection and convenience. Passkeys provide a modern, phishing-resistant way to sign in using a device's built-in authentication such as Face ID, fingerprint or PIN. They are described as faster and more secure than passwords or SMS codes.
Recent updates to Microsoft account sign-in now support passkeys with device biometric authentication, making phishing virtually impossible. The official Microsoft Support website offers details on protecting a Microsoft account. Users are advised to check the Security section of their Microsoft account dashboard to review current settings.
Xbox owners have occasionally lost access to digital game libraries after accounts were hacked. The company recommends reading the "How to help keep your Microsoft account secure" page on its website to improve settings and avoid potential fraud. The shift underscores Microsoft's commitment to passwordless authentication across personal accounts.
EXPERT TAKE
Expert Take: Cloud admins should audit Microsoft account security settings now to migrate users to passkeys and Authenticator before SMS options disappear entirely.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.