What do staff without a smartphone use for Microsoft 365 sign-in when texted codes end?

Microsoft's pages don't ask the question that way, so this page sorts the methods they describe by what a person needs to hold or use. Facts are from Microsoft's own pages, read October 27, 2026.

Updated 2026-10-27

Short answer. Microsoft's retirement page and FAQ do not use the word "smartphone" (we searched both). Other Microsoft pages describe sign-in methods held on a physical security key or a Windows PC, and codes from one-time-code tokens. We can't see your tenant, so we can't say which of your staff are in scope.

Passkeys and phones

The retirement page gives these examples of a device-bound passkey: "Passkey in Microsoft Authenticator, Entra Passkey on Windows, FIDO2 hardware security key, and so on". Microsoft's passkey deployment guide places the first on phones: "Register passkeys in Microsoft Authenticator App on Android or iOS devices."

A FIDO2 security key

Microsoft's security key page says: "FIDO2 security keys are device-bound passkeys stored on a physical authenticator." Its first-time steps start at Security info in a web browser, then say "Sign in with multifactor authentication (MFA)." and, for a key, "Follow the prompts to connect your security key and provide a PIN or biometric method."

Microsoft's compatibility matrix lists limits by platform: near-field communication (NFC) and Bluetooth Low Energy (BLE) security keys "aren't supported on macOS by Apple", and "Security key registration isn't supported on ChromeOS or Chrome browser."

Windows Hello and the Windows passkey

The Windows Hello for Business overview says Windows Hello "allows users to sign in to their Windows devices using biometric data, or a PIN, instead of a traditional password." Of the Windows passkey, the deployment guide says: "Microsoft Entra passkey on Windows are device-bound and do not sync across devices; each device requires separate registration per Microsoft Entra account."

A synced passkey on a computer

Microsoft's passkey setup page has a table of minimum device requirements for synced passkeys. It lists Google Password Manager as "Built into Chrome" on Windows and macOS, and Apple Passwords as "Natively built in. macOS 13+" on macOS. The pages we read don't say whether setting one up needs a phone.

Codes from a one-time-code token (TOTP)

Microsoft's FAQ gives these lines in its answer to a question about organizations in China: "TOTP remains supported for existing and new registrations after February 1, 2027, subject to your organization's policies. Users who have registered and use TOTP for MFA won't receive the blocking passkey registration prompt." The FAQ does not say whether they apply beyond that answer. The same FAQ adds that TOTP "isn't phishing-resistant and doesn't satisfy a Conditional Access policy that requires phishing-resistant authentication."

Microsoft's OATH tokens page has a section headed "Hardware OATH tokens (preview)" and says: "Customers can purchase these tokens from the vendor of their choice." Software tokens are apps such as Microsoft Authenticator, which the deployment guide says users sign in to "directly on their iOS or Android device"; the FAQ also allows "another OATH TOTP-compatible app".

The telephony-provider route

For organizations that still need texted or phoned codes, the FAQ describes a telephony provider contracted through Microsoft Security Store. It says "Soprano and Telesign are the initial telephony providers available during the private preview" and "The configuration experience becomes available beginning October 30, 2026." It adds "Pricing varies by telephony provider and region." For Global Administrators and external users it gives July 1, 2027.

The provider page's planning list includes "Confirm that a phishing-resistant method doesn't meet the requirement." Neither page says whether staff without a smartphone count under the FAQ's "business, regulatory, or technical need".

What Microsoft's pages do not cover

Prices for security keys or tokens: none of the pages quoted here gives one, so we give none.
Landlines and basic phones: the retirement page and FAQ mention neither (we searched both).
Which method fits which person at your firm.

For a person with no working sign-in method, the deployment guide says: "For new users or users without MFA, go through a process to issue users a TAP." The guide page links Microsoft's steps for a Temporary Access Pass.

Next step

Passkey Switch writes the switch plan for your firm by email: US$249, nothing added, one time. We never log in to your tenant or take passwords or codes. Full refund on request within 14 days of purchase if the work has not been delivered, or if you tell us it did not meet the offer (terms). This is IT how-to writing, not legal or compliance advice.

Order by email See the pack and what it costs

Other questions: can staff skip Microsoft's passkey prompt? and shared front-desk logins and computers.

Sources, all Microsoft Learn and all read October 27, 2026: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication, dated 2026-09-23, and its FAQ, dated 2026-10-20; Choose a telephony provider, 2026-09-23; Register a passkey with a FIDO2 security key, 2026-07-05; Passkey (FIDO2) authentication matrix, 2026-04-16; Plan a phishing-resistant passwordless authentication deployment, 2026-03-26; How to enable passkeys (FIDO2), 2026-03-08; OATH tokens, 2025-03-04; Windows Hello for Business overview, 2026-03-29. Passkey Switch is not affiliated with Microsoft, which can change its dates and steps; check its pages before you act. Written by Ellis, an AI assistant.