In This Guide
- What a Passkey Actually Is
- Passkey vs Password vs SMS Code vs Authenticator App
- What Microsoft Is Changing — and When
- The Australian Picture: myGov, Banks and Scam Texts
- Step-by-Step Guides for Your Device
- Not in Brisbane? Local Help in Other Cities
- What Happens If You Lose Your Phone?
- What to Do This Week
If a Microsoft sign-in screen has recently told you to "Sign in faster" or "Create a passkey", you're not imagining it. Since 1 September 2026 Microsoft has been switching work and school accounts over to passkeys by default, and it has said it will phase out SMS codes on personal accounts too.
For most people that's a good change. Passkeys are faster and much harder to steal than a password plus a texted code. But the switch has been rough. Since September we've had a steady rise in calls from people across Brisbane who are stuck: codes that never arrive, a new phone that won't take their Authenticator, or a prompt they can't get past.
This is the overview. Each section links to a step-by-step guide for your device or account.
1. What a Passkey Actually Is
A passkey is a sign-in that replaces your password, and usually the text-message code as well. Instead of typing something, you unlock your phone or computer the way you already do — Face ID, a fingerprint, or your device PIN — and you're in.
Behind the scenes your device creates a matching pair of digital keys. One half is stored with the website (Microsoft, myGov, Google). The other half never leaves your device or your password manager, and it only works after you unlock it. There's no secret to type, so there's nothing for a scammer to trick out of you. A fake login page can't capture a passkey, because it only works on the real website it was made for.
Face ID, Touch ID or your Windows Hello fingerprint only unlocks the passkey on your own device. Microsoft, Apple and myGov never receive your face or fingerprint.
Passkeys come in two kinds, and the difference matters a lot when you replace a phone:
Synced passkeys
Saved to iCloud Keychain, Google Password Manager or a password manager, and copied to your other devices. Lose the phone and the passkey survives.
Device-bound passkeys
Stay on one device or security key. The passkeys Microsoft Authenticator creates for work and school accounts are like this — they do not move to a new phone.
2. Passkey vs Password vs SMS Code vs Authenticator App
Here's how the sign-in methods you're likely to meet compare:
| Method | How you use it | Can a scammer steal it? | Where it's heading |
|---|---|---|---|
| Password | Type it | Yes — phishing, reuse, leaks | Being removed where possible |
| SMS / voice code | Code texted or read to your phone | Yes — phishing and SIM-swap | Being phased out by Microsoft; banks adding alternatives |
| Authenticator app code or approval | Open the app, approve or type the code | Harder, but codes can still be phished | Staying — Microsoft Authenticator is not being discontinued |
| Passkey | Unlock with face, fingerprint or PIN | Very hard — nothing to type or hand over | The new default |
Microsoft's own wording is blunt: SMS-based authentication is "now a leading source of fraud", and it is "vulnerable to phishing and SIM-swap attacks". That's the reason for the push.
3. What Microsoft Is Changing — and When
This is where most of the confusion comes from, because there are two different timelines depending on what kind of Microsoft account you have.
| Account type | Examples | What's happening |
|---|---|---|
| Work or school account (Microsoft Entra ID) | Your business Microsoft 365, Teams and Outlook login; a school or uni account | 1 Sep 2026: passkeys switched on by default and users prompted to register one. 1 Feb 2027: Microsoft-provided SMS and voice codes retired for most users. 1 Jul 2027: the same for Global Administrators and external users. |
| Personal Microsoft account | Outlook.com, Hotmail, Live, Xbox, OneDrive, a home Microsoft 365 Family plan | Microsoft says it will "start phasing out SMS" for sign-in and account recovery. No end date has been published. Many accounts already can't add a new phone number. |
You'll see it quoted for Hotmail and Outlook.com accounts online. Microsoft hasn't said that. Personal accounts are being moved gradually, with no published cut-off.
For business accounts, Microsoft's FAQ is clear that people won't simply be locked out on 1 February. Instead, anyone whose only sign-in method is SMS or a voice call will get a passkey setup screen they can't skip. If they don't have a phone or computer that can hold a passkey, that's where they get stuck. Staff who already use Authenticator approvals, Windows Hello or a security key carry on as normal.
Businesses that genuinely need text codes can keep them by contracting a paid SMS provider through Microsoft. Moving people to passkeys costs nothing.
Full detail, including the personal versus work account split: Microsoft passkeys: personal vs work account setup guide.
4. The Australian Picture: myGov, Banks and Scam Texts
Microsoft isn't the only one. Australia is moving the same way:
myGov
Already supports passkeys, up to three per account, on iPhone, Android, Windows and Mac. Guide: myGov passkeys and codes.
Banks and cards
Visa told Australian card issuers they must offer something better than an SMS code as the only check on online payments by October 2026. Some banks, such as ubank and ANZ Plus, already use passkeys or app approval. None of the big four has set a date to stop sending SMS codes.
Scam texts
Since 1 July 2026, texts sent under a business name must use a registered sender ID. Unregistered ones can show as "Unverified" — one more reason codes by text are falling out of favour.
Apple and Google
Both support passkeys. Apple still sends two-factor codes to your trusted phone number, and Google lets you keep your existing recovery options when you add a passkey.
5. Step-by-Step Guides for Your Device
Pick the one that matches what's in front of you:
- Microsoft is asking me to create a passkey — personal vs work accounts, Windows Hello, Security Info.
- Moving Microsoft Authenticator to a new phone — including when the old phone is lost or broken.
- Passkeys on iPhone, iPad and Mac
- Passkeys on Android and your Google account
- myGov passkeys, codes that don't arrive and locked accounts
- Locked out of your Microsoft account and can't reach anyone
Running a business? Our older guide to multi-factor authentication on Microsoft 365, Google and Xero covers the admin side.
6. Not in Brisbane? Local Help in Other Cities
The Geeks team covers five other cities with the same remote and onsite help. Each local guide explains how lockout help works there:
Sydney
Locked out of Microsoft? Help in Sydney — Geeks Sydney
Melbourne
Locked out of Microsoft? Help in Melbourne — Geeks Melbourne
Perth
Locked out of Microsoft? Help in Perth — Geeks Perth
Canberra
Locked out of Microsoft? Help in Canberra — Geeks Canberra
Adelaide
Locked out of Microsoft? Help in Adelaide — Geeks IT Adelaide
7. What Happens If You Lose Your Phone?
This is the question everyone asks, and it's the one that causes real lockouts.
- Synced passkeys (iCloud Keychain, Google Password Manager, 1Password, Bitwarden and similar) come back when you sign in to your new phone with the same Apple or Google account.
- Device-bound passkeys, including those in Microsoft Authenticator for work accounts, do not come back. Microsoft says they "can't be synced". You set up a new one on the new phone.
- If the passkey was your only way in, you're relying on account recovery, which for personal Microsoft accounts is an automated form with no human override.
Register at least two ways in: a passkey on your phone and one on your computer, or a passkey plus a verified recovery email. myGov allows three passkeys and Microsoft allows up to ten sign-in methods. Use them.
8. What to Do This Week
- Check what you have. Personal account: account.microsoft.com → Security. Work account: My Sign-Ins → Security info.
- Add a passkey before you need it, while your text codes still work.
- Add a second way in — a recovery email on personal accounts, a second passkey or Authenticator on work accounts.
- Don't delete your phone number until the new method works. Many personal accounts can't add a number back.
- Turn on your screen lock. Passkeys won't work on a phone or computer without a PIN, face or fingerprint.
- Keep your old phone until everything works on the new one.
Rather Have Someone Do It With You?
We set up passkeys and backup sign-ins across your phone, computer, Microsoft and myGov in one sitting — remotely or at your place.
Book HelpRemote support is $125/hr and an onsite visit is $205/hr, with a one-hour minimum. You'll know the cost before we start.
Sources
Microsoft Learn — Passkeys by default and retirement of Microsoft-provided SMS and voice authentication and its FAQ · Microsoft Support — Microsoft to stop sending SMS codes for personal accounts · Microsoft Security Blog, 1 May 2025 · myGov — Use passkeys · Microsoft passkey FAQ · Apple — Two-factor authentication · Google — Passkeys. Checked 11 October 2026.