Microsoft is ending its own text-message and voice sign-in codes on February 1, 2027. If your team still gets a six-digit code on their phone, that clock is already running.
Here's why it matters more than it sounds. A code can be handed over. Someone builds a convincing fake login page, your office manager types her password and reads the code off her phone, and the attacker is in - MFA and all. Microsoft's threat researchers reported AI-written phishing emails hitting click-through rates as high as 54%, versus roughly 12% for the old-fashioned kind. Your staff aren't getting worse at spotting these. The fakes are getting better.
Passkeys and Windows Hello work differently. A glance at the camera or a fingerprint unlocks a key that never leaves that specific laptop. Nothing to type means nothing to hand over, and nothing for a fake page to collect.
For a medical practice there's a second payoff people notice faster than the security one: your front desk signs in forty times a day. A look at the camera beats a 14-character password every single time.
Most of the laptops I see in practices already have the hardware for this. The change is coming either way - better to do it on your own calendar than on Microsoft's.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email