On September 1, Microsoft started moving Microsoft 365 users off text-message sign-in codes by default.
If your team still gets a texted code to log in, they're now being prompted to set up a passkey instead. And on February 1, 2027, Microsoft stops sending those texts and calls itself. Keeping them after that means paying an outside provider to deliver them.
This is exactly what a quarterly tenant review is for. Once a quarter we sit down with a client's Microsoft tenant and check the unglamorous things: who is still on a sign-in method that's about to disappear, which admin accounts have no backup way in, which mailboxes belong to people who left in March, what a departing advisor could still open from their phone.
None of that ever shows up as a help desk ticket. It shows up on a Monday morning when a senior advisor can't get into email before a client meeting, or when the one person who approves wire instructions is locked out of their account.
Ninety minutes a quarter, on the calendar. That's the whole fix. If nobody has looked at your tenant since the day it was set up, it's worth doing before your next cyber renewal, because your carrier is going to ask.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email