SmishAlert
← Blog

SMS Phishing: Microsoft 365 Admins Face the 2027 Passkey Shift

SMS Phishing: Microsoft 365 Admins Face the 2027 Passkey Shift

An unrequested Microsoft 365 SMS verification code should be treated as a compromise signal, not a routine prompt. The user did not trigger it, which means someone else already has a password or session token and is trying to finish the sign-in. The right posture is immediate: tell the user not to share or approve the code, and start admin triage right away, because SMS remains phishable and Microsoft is actively retiring it in favor of passkeys.

TL;DR:

  • Microsoft retires SMS and voice delivery in early 2027; Global Admin and external user access end midyear unless tenants use their own telecom provider.
  • Repeated unrequested codes, urgent lockout threats, clickable links, and unfamiliar sender details are warning signs; legitimate MFA codes never contain clickable links.
  • Admins should preserve device logs, review audit logs, authentication methods, OAuth grants, and risky sign ins, then remove unfamiliar methods and revoke sessions.
  • Disable SMS fallback for admin accounts first; number matching offers interim protection, while passkeys, hardware keys, and Windows Hello for Business resist phishing.
  • Email gateways cannot see SMS, iMessage, or WhatsApp phishing, so teams need employee reporting, campaign correlation, and SIEM integration to connect messages with security alerts.
SmishAlert
See Beyond Email Security
SmishAlert helps security teams collect and analyze suspicious texts, correlate reports, and identify coordinated mobile messaging attacks.
Explore SmishAlert

Table of Contents

Why SMS-Based MFA Is Vulnerable and What Microsoft Is Changing

SMS was never designed as an authentication channel, and several well-documented techniques exploit that gap. SIM swap attacks let an adversary port a victim’s number to a device they control. SS7 interception abuses weaknesses in telecom signaling to reroute texts. Adversary-in-the-middle (AiTM) reverse-proxy phishing captures both the password and the one-time code in real time, then replays the session. Push and approval fatigue, meanwhile, relies on volume: attackers trigger repeated prompts until a user approves one out of frustration.

Microsoft’s own Entra ID documentation confirms the shift away from text-based verification: passkeys are now the default sign-in experience, passkey registration will auto-enable for SMS and voice users starting later in 2026, and Microsoft-provided SMS and voice delivery retires in early 2027, with Global Admin and external-user access retiring mid-2027, unless a tenant configures its own telecom provider.

SMS and voice MFA are explicitly classified as non-phishing-resistant by CISA’s mobile communications guidance, which recommends migrating to FIDO-based keys or passkeys wherever feasible.

What this means for admins planning ahead:

  • SIM swap and SS7 interception can redirect codes without touching the victim’s device.
  • AiTM proxies harvest credentials and session tokens in a single phishing flow.
  • Approval fatigue turns legitimate MFA prompts into an attack surface.
  • Microsoft’s retirement timeline makes migration a 2026-2027 planning requirement, not an optional upgrade.

How to Spot SMS Phishing That Targets Microsoft 365 Accounts

Most Microsoft 365 SMS phishing follows a recognizable pattern once you know what to look for.

  1. Unrequested codes arriving with no matching sign-in attempt from the user.
  2. Urgent help-desk pretexts that claim an account will be locked or disabled unless the user acts immediately.
  3. Embedded links in a text claiming to be from Microsoft, since legitimate MFA codes never include a clickable link.
  4. Repeated code requests within minutes, which usually signal an attacker retrying a failed AiTM session.
  5. Short codes or numbers that don’t match prior Microsoft communications, including spoofed sender IDs.

Behaviorally, watch for device-code flows initiated outside normal hours, authorization prompts tied to unfamiliar device names, and number-matching entries that don’t correspond to anything the user attempted. The Threadlinqs intelligence writeup on passkey-themed help-desk phishing documents campaigns where attackers impersonate internal IT, walk victims through a device-code or passkey registration flow, then use the resulting access to pull data through Microsoft Graph at scale.

Pro Tip: Treat any SMS-based request to “verify your identity by entering this code on our site” as phishing, regardless of how official the sender name looks.

Immediate Admin Response: Triage and Contain

When a user reports an unexpected Microsoft SMS code, speed matters more than process polish, but evidence still has to survive the response.

First, instruct the user not to share, forward, or enter the code anywhere, and preserve their device logs rather than clearing notifications. Then move into Entra ID investigation: pull audit logs for the account, inventory registered authentication methods for anything unfamiliar, review OAuth grants and app consents, and check recent and risky sign-ins. Microsoft’s own guidance on responding to a compromised account walks through exactly this sequence: audit log review, authentication method checks, OAuth grant review, and automated investigation tools to contain the incident.

  • Remove any authentication method the user didn’t register.
  • Force sign-out across all sessions and reset refresh tokens.
  • Apply Conditional Access blocks on the affected account pending review.
  • Escalate to incident response if Graph API activity or mail-rule changes appear alongside the suspicious code.
Investigative step Where to look What it reveals
Audit log review Entra ID audit logs Timing of sign-in attempts and MFA registration changes
Authentication method inventory Entra ID per-user authentication methods Unauthorized phone numbers or authenticator apps added
OAuth grant and consent review Entra ID enterprise applications Attacker-registered apps or scopes granted after compromise
Sign-in risk review Entra ID risky sign-ins report Impossible travel, anomalous IP, or token replay indicators

For a walkthrough of how these flows typically present to end users, our Microsoft account text scam playbook covers common SOC triage steps alongside real message examples.

Safer Alternatives and How to Migrate Users Off SMS

Passkeys (FIDO2), hardware security keys, and Windows Hello for Business are phishing-resistant because they bind the credential to the specific domain and device, which defeats AiTM proxies and makes SIM swap irrelevant since there’s no code to intercept.

Passkey bound to a device and domain

While full migration is underway, Microsoft Authenticator with number matching closes some of the gap, since it requires the user to enter a number shown on the sign-in screen rather than tapping “approve.” CISA’s phishing-resistant MFA fact sheet frames number matching as a useful interim control, not a substitute for passkeys or hardware keys.

A practical rollout plan:

  1. Inventory high-value accounts first: executives, finance, IT admins, and anyone with standing access to sensitive systems.
  2. Pilot passkey registration with a small, cooperative group before a tenant-wide push.
  3. Communicate the change clearly, including why SMS codes will stop working and what to expect instead.
  4. Arm the help desk with scripts for passkey registration issues and for distinguishing real support calls from vishing attempts.
  5. Monitor registration progress through Entra reporting and nudge stragglers with a registration campaign before SMS retirement dates hit.

Pro Tip: Disable SMS as an MFA fallback for admin roles first. Attackers target privileged accounts because the payoff is higher and the fallback option is often left enabled the longest.

How Security Teams Gain Visibility Into Messaging-Based Social Engineering

Email security gateways have no view into SMS, iMessage, or WhatsApp traffic, which is exactly where Microsoft-themed phishing increasingly lands; for secure alternatives to SMS and email channels, see Secure Sensitive Documents: Fax or Email | PerPageFax. A help-desk-impersonation text never touches a mail server, so a SOC built entirely around email telemetry has a structural blind spot for the channel attackers are actively shifting toward.

Closing that gap requires a way to collect what users are seeing on their phones and turn scattered reports into a pattern. Useful capabilities include:

  • Frictionless reporting workflows for employees, customers, and members to flag suspicious texts without installing a dedicated app.
  • Automated analysis of reported senders and message content for credential phishing, executive impersonation, and fraud indicators.
  • Correlation across reports to surface coordinated campaigns rather than treating each text as an isolated incident.
  • SIEM and API integration so messaging reports feed the same workflows as email and endpoint alerts.

Pro Tip: Feed correlated messaging reports alongside Entra sign-in and audit logs; a spike in SMS phishing reports often precedes a wave of MFA-targeted sign-in attempts by hours, not days.

How SmishAlert Helps Detect and Respond to Microsoft-Targeted SMS Campaigns

We built SmishAlert around the gap described above: the moment social engineering moves from email into text messages, most security stacks stop seeing it. We give security teams a way to collect reported messages from employees, customers, or members, analyze senders and content for executive impersonation and credential phishing, and correlate reports across a population to catch coordinated Microsoft-themed campaigns before they spread further.

That visibility matters most when unexplained MFA prompts start showing up across multiple users at once, or when a help-desk-impersonation campaign targets a specific department. Our platform routes those reports into existing SOC workflows through SIEM and API integration, and produces audit-ready incident data for compliance review.

If your organization wants a structured way to protect employees from executive impersonation delivered via text, start with an enterprise assessment pilot to see how messaging threats look across your own user population.

FAQ

What does a Microsoft phishing email look like?

A Microsoft phishing email typically spoofs a Microsoft sender address, uses urgent language about account suspension, and includes a link to a fake sign-in page that harvests credentials. Legitimate Microsoft security alerts never ask you to enter your password through an embedded link.

Which type of phishing attack uses SMS text messages?

Smishing is the term for phishing conducted through SMS text messages, often impersonating a trusted brand like Microsoft to request a one-time code or credential confirmation. It frequently pairs with AiTM reverse-proxy techniques to capture both the password and the MFA code in a single flow, as documented in recent passkey-themed help-desk phishing campaigns.

What are 7 signs of phishing?

Common signs include an unrequested verification code, urgent threats about account lockout, embedded links in security messages, mismatched sender names, requests to call an unfamiliar number, repeated code prompts in a short window, and pressure to act before “verifying” through an unofficial channel. Any one of these on its own warrants caution, and several together strongly suggest phishing.

How to check if Outlook is hacked?

Review your Entra ID sign-in activity for unfamiliar locations or devices, check registered authentication methods for anything you didn’t add, and look at mailbox rules for unexpected forwarding addresses. Microsoft’s guidance on responding to a compromised account outlines the same audit log, authentication method, and OAuth grant review used in formal incident response.

Sources