Do you use SMS as two step authentication?

From 1 September 2026, Microsoft will begin the process of phasing out SMS as a method for two-factor authentication.

Sometime after 1 September, if you have set up SMS as your two-factor method, you will be notified of the change and encouraged to switch to a different two-factor authentication method.

From 1 February 2027, it will no longer be possible to use SMS for two-factor authentication, and by that time you must have switched to an alternative method.

What do I need to do?

It will still be possible to use SMS for two-factor authentication until 1 February 2027. You will receive reminders from Microsoft to change method from 1 September 2026 until the phase-out on 1 February 2027.

If you do not want to receive these reminders, you can easily switch to another two-factor authentication method for your account.

If SMS is your only form of two-factor authentication

If SMS is your only form of two-factor authentication, we recommend that you reset your two-factor authentication and set up a new method.

• Read about how to reset your two-factor authentication.

If SMS is your preferred method, but you have also set up other methods

If you have set up one or more other methods, but primarily use SMS, we recommend that you update your preferred method. This can be doen in two ways - either by resetting your two-factor authentication and setting it up again with a method other than SMS, or by changing the priority of your existing methods.

• Read about how to reset your two-factor authentication.
• Read about how to change the priority of the methods you have set up - you only need to do step 14 and 15.

If you choose to change the priority of your methods, you might encounter the message shown below. If this happens, you should select "Not now" ("Ikke nå") in order to go straight to the admin page.

Why is SMS being phased out as a two-factor method?

Microsoft states that security is the main reason SMS is being phased out. SMS as a two-factor method is easy to misuse in phishing attacks and provides weaker protection against account attacks.