Microsoft is retiring SMS (text message) authentication on February 1, 2027. After this date, SMS will no longer be available as an MFA method for any University of Windsor accounts. If you currently receive a text message containing a verification code when signing in to your UWin Account, you should set up a passkey well in advance of February 1, 2027 deadline. This article answers frequently asked questions about this change, how it may affect you, and what you should do before the deadline.
Frequently Asked Questions
A passkey is a more secure and convenient way to verify your identity and sign in to your account. It can replace your username and password when signing in, or it can be used to complete MFA instead of receiving and entering a six-digit verification code by text message.
Passkeys provide strong, phishing-resistant authentication and are becoming the new standard for signing in, gradually replacing traditional usernames and passwords. For most users, passkeys also provide a faster, simpler sign-in experience, without the need to remember a password or enter verification codes.
More information: What is a passkey?
What happens to my account after Feb 1 if I do not register a passkey?
If SMS is your only configured MFA method, starting Feb 1, 2027 you will be required to register a passkey the next time you sign in. This registration prompt can no longer be skipped. You must complete the passkey registration before you can continue signing in to your UWin Account.
I use a Windows Hello PIN. Do I still need to do anything?
Yes. If you use Windows Hello for Business, you may not see Microsoft’s prompts encouraging you to register a passkey because Windows Hello already provides a phishing-resistant sign-in method.
You should still register a passkey. While you should be able to continue signing in on a computer where Windows Hello is set up and working after Feb 1, you may need another authentication method when signing in from a different device or if Windows Hello is unavailable.
IT Services recommends reviewing your registered authentication methods and adding a passkey through My Sign-Ins website. Having a passkey provides another secure, phishing-resistant way to verify your identity when Windows Hello cannot be used.
More information: What is Windows Hello for Business?
Why am I not getting prompted to register a passkey?
Microsoft has introduced a passkey registration campaign that can prompt eligible users to set up a passkey. However, there is an important limitation: the registration prompt is presented as part of an interactive Microsoft sign-in experience after the user completes MFA.
In practical terms, this means you should not rely on receiving a prompt before registering your passkey. If you sign in through a web browser and are required to complete MFA, you may receive the passkey registration prompt. However, if you routinely use Windows Hello for Business, you may rarely or never encounter an MFA challenge during web authentication. As a result, the opportunity for the registration campaign to display its prompt may not occur.
This is an important distinction: being eligible for Microsoft's passkey registration campaign does not guarantee that you will see a passkey registration prompt. The campaign relies on the appropriate interactive authentication flow being triggered. Do not wait for Microsoft to prompt you. If you have not yet registered a passkey, you can set one up manually.
Another possibility is that you have already seen the prompt but did not realize that it was asking you to register a passkey. This is because the message does not explicitly mention passkeys. Instead, the prompt begins with “Let’s make your account more secure.”
What happens after I register a passkey?
Once you have registered your passkey, start using it whenever possible. You can use your passkey to sign in instead of entering your username and password, or to verify your identity instead of receiving an SMS (text message) code when MFA is required.
As part of the transition, SMS authentication will be removed from your account approximately 7 to 14 days after you register a passkey, making your passkey your primary authentication method.
Transitioning users away from SMS gradually, well ahead of Microsoft's retirement deadline, helps identify and resolve any sign-in issues early and reduces the risk of widespread disruption when SMS authentication is retired.
Are passkeys just for MFA?
No. A passkey can be used to sign in to your Microsoft work or school account instead of entering your username and password.
No separate MFA license is required to register or use a passkey. This means that all eligible user types, including Alumni and Retirees who are not licensed for MFA, can register and use a passkey with their Microsoft work or school account to make it more secure.
Can I store multiple passkeys on the same USB security key?
Yes. A FIDO2 USB security key can store multiple passkeys, allowing you to use the same physical security key with multiple accounts and services. The maximum number of passkeys that can be stored depends on the specific security key model.
For example, you can register the same security key with both your Microsoft work or school account and other non-University of Windsor services that support passkeys, such as banks, government agencies, Facebook, Google, etc. Each account stores its own separate passkey on the security key.
Will passkeys work on all classroom and lab computers on campus?
Not yet. When you use a passkey stored on your phone to sign in on another computer, both your phone and the computer must support Bluetooth. Some classroom and computer lab workstations on campus currently do not have Bluetooth capability.
IT Services is working with departments to address this limitation. In the meantime, if you need to complete MFA on an affected computer, you can use the Microsoft Authenticator app with push notifications instead.
More information: How to download and set up Microsoft Authenticator on your mobile device