Three dates matter. On July 13, 2026, Microsoft announced that passkeys would replace text and voice codes as the default sign-in method for Microsoft 365 (Entra ID announcement MC1426371). On September 1, passkeys became the default, and anyone still using text or voice codes started seeing a prompt to set one up at sign-in. On February 1, 2027, Microsoft's own text and voice codes retire.
That last date is right in the middle of busy season, which is exactly why the time to plan a firm's rollout is now, not January. Here is what a passkey is, in the plain language we use with client staff, and what a firm owner should do about the deadline.
A password is a secret you repeat. A passkey is a key that only works at the real door.
A password is a secret you type into whatever sign-in page is in front of you. A fake page accepts it just as happily as the real one, and once typed, it can be copied and reused anywhere. That is the entire business model of phishing.
A passkey is a pair of keys made on your device. The private half never leaves your phone or PC. When you sign in, the real site sends a challenge and your device signs it after you unlock with your face, fingerprint, or PIN. A look-alike page at the wrong address gets a signature that does not fit its lock, so phishing simply fails. There is nothing to steal and nothing to replay.
From the user's chair it feels like Face ID or Windows Hello. The difference is where the secret lives: a password lives in your head and on their server; a passkey never leaves your device. Two questions staff always ask, and the answers: your fingerprint never leaves the device, it only unlocks the key; and if you lose your phone, the account is not lost, because your technology team keeps a backup method and verifies you before issuing a new one.
What the deadline means for your firm
Text and voice codes. If your firm already retired SMS codes for Microsoft 365 in favor of an authenticator app, the February 1 retirement needs nothing from you. If anyone in the firm still signs in with a text message, that is the first thing to fix, and not because of the deadline: SMS codes are the weakest form of MFA, and SIM swapping (moving your phone number to a criminal's SIM) is how they get hijacked.
Microsoft 365 passkeys. For most firms the rollout is a scheduled project: a two-minute setup per person with face, fingerprint, or PIN, a confirmed backup method for everyone, and a date chosen outside the peak weeks. Done well, staff barely notice the change except that sign-in gets faster.
Your existing MFA app. If your firm uses a separate MFA approval step for Microsoft 365 and for the computer itself, it stays as it is through the transition. The rule that goes with it stays too: approve only pushes you asked for. A push you did not trigger means someone has your password; deny it and report it.
Where passkeys fit in the IRS Security Six
IRS Publication 4557 and the Security Summit name six basics every tax office should have, and auditors, insurers, and the FTC Safeguards Rule all point at the same list. For a well-run firm, five of the six are already running on the computers it manages, each with one small thing it asks of staff:
- Anti-virus software. Monitored protection on every company computer, updated nightly. The ask: restart when prompted.
- Firewalls. On every machine, managed centrally. The ask: nothing, leave it on.
- Multi-factor authentication. On every sign-in to Microsoft 365 and to the computer itself; passkeys are the next step up. The ask: approve only your own pushes.
- Backup. Microsoft 365 backup covers email, OneDrive, and SharePoint automatically. The ask: save to OneDrive or SharePoint, never the C: drive, which is not backed up.
- Drive encryption. Full-disk encryption on every laptop, so a lost device is a lost device, not a reportable breach. The ask: report a lost device within the hour so it can be locked remotely.
- Secure connection. Microsoft 365 traffic is encrypted today; a firm-wide secure-access layer is the item most firms have not finished. The ask, and the single most important line in any briefing: work accounts only on the computer the firm manages. Not a personal laptop, not a family PC, not a phone browser.
That last ask matters most this year. The company computer is the one that is patched overnight, encrypted, monitored, and can be locked or wiped within minutes if it goes missing. A personal device is none of those things, and in a security team's alerts, a sign-in from a personal device is indistinguishable from a threat actor's.
Why the everyday habits are your compliance evidence
The FTC Safeguards Rule (16 CFR Part 314) applies to tax and bookkeeping firms as financial institutions, and IRS Publication 4557 plus the WISP requirement sit on top. Both require a written plan with specific controls. The useful thing to tell staff is that those controls are habits they already have. Approving only your own MFA push is the rule's multi-factor authentication requirement. Keeping client files on the company computer, OneDrive, and SharePoint is its encryption and access-limit requirement. Reporting phishing and finishing the monthly training lesson is its staff-training requirement. Calling the minute something feels off is its incident response requirement, which matters because the rule requires notice to the FTC within 30 days for breaches affecting 500 or more people, and the IRS asks preparers to report data theft to their stakeholder liaison right away. Letting your technology team verify your identity before a reset is its access-control requirement.
A firm whose team lives those habits is a firm whose WISP describes reality, and that is what a regulator, an insurer, or a buyer in due diligence is actually checking. Our guide to what a WISP has to contain walks through the full list.
What to do before February 1
- Inventory who still uses text or voice codes for Microsoft 365, and move them to an authenticator app now.
- Schedule the passkey rollout outside peak weeks. January is too late; December and the early weeks of the new year are workable.
- Confirm a backup sign-in method for every person before their passkey is issued, and document how identity is verified before a replacement.
- Tell staff what they will see. A prompt to set up a passkey at sign-in is expected; a phone call asking them to read a code is not. The two will arrive the same month.
- Ask about international travel and offline access ahead of time. Sign-in restricted to approved countries is a strong control only if the team tells you their travel dates, and offline MFA codes should be set up and tested before anyone boards a plane.
If you would rather not run this alone, this is core to what we do: every Tech Guru client firm's rollout is scheduled, staffed, and verified by us, with the backup methods confirmed and the briefing delivered to staff before anything changes.
This article is educational content, not legal advice. Microsoft's dates are taken from its Entra ID announcement of July 13, 2026 and may change; confirm the current schedule in the Microsoft 365 admin message center. Regulatory obligations depend on your firm's specifics; have your attorney review your WISP and incident response plan.
