Sample pack
Sample for a made-up 12-person firm, Example Accounting LLP. Every name, staff date and choice below is invented; Microsoft's own dates are real. A real pack is longer and uses your staff, your devices and your dates. Microsoft controls sign-in; this describes the steps Microsoft documents. Sources are listed at the bottom.
1. Per-person plan
Assumed: everyone signs in to Microsoft 365 with a texted code today. Methods below are our planning choices from the types Microsoft's documentation lists (synced passkeys, passkeys in Microsoft Authenticator, FIDO2 security keys). The full pack also names security-key models for the shared desk and no-smartphone staff.
| # | Person | Device | Moves to | Note |
|---|---|---|---|---|
| 1 | Dana Reyes (partner) | iPhone | Synced passkey (Apple Passwords / iCloud Keychain) | Set Up Codes In set to Passwords (see iPhone guide, section 4) |
| 2 | Marcus Webb (partner) | Android | Passkey in Microsoft Authenticator | Needs Android 14 or later |
| 3 | Priya Nair (senior accountant) | iPhone | Synced passkey (Apple Passwords) | Same as row 1 |
| 4 | Tom Okafor (accountant) | Android | Synced passkey (Google Password Manager) | Choose provider in Android settings |
| 5 | Lena Fischer (accountant) | iPhone | Passkey in Microsoft Authenticator | Needs iOS 17 or later |
| 6 | Sam Ito (bookkeeper) | Android | Passkey in Microsoft Authenticator | Needs Android 14 or later |
| 7 | Grace Alvarez (bookkeeper) | Windows PC only, no smartphone | FIDO2 security key (device-bound) | Key kept by Grace; spare key in the office safe |
| 8 | Front desk (shared account, Example Accounting) | Shared desk PC | FIDO2 security key (device-bound) | Key stays at the desk; named person responsible for it |
| 9 | Owen Brandt (tax preparer) | iPhone | Synced passkey (Apple Passwords) | Same as row 1 |
| 10 | Hana Kim (tax preparer) | Android | Synced passkey (Google Password Manager) | Same as row 4 |
| 11 | Victor Mensah (admin assistant) | iPhone | Passkey in Microsoft Authenticator | Needs iOS 17 or later |
| 12 | Office manager (Global Administrator) | iPhone | Passkey in Microsoft Authenticator + a FIDO2 key for the emergency account | Global Administrators: Microsoft's date is 2027-07-01; plan to move before it |
2. Admin click-path (Microsoft Entra admin center)
Done by the firm's admin. We never log in; you click, and the pack tells you what to click and what to write down.
- Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
- Browse to Entra ID > Security > Authentication methods > Policies, then select Passkey (FIDO2).
- Passkey profiles: Microsoft's page says to select the link in the banner to opt in to passkey profiles, and that after you opt in you can't opt out. Your existing settings move to a Default passkey profile.
- On the Configure tab, set Allow self-service set up to Yes. Select the Default passkey profile, choose the Passkey types you allow (Device-bound, Synced), and select Save. In this sample: both.
- On Enable and target, select Add target, then All users or Select targets for specific groups. Save.
- Optional, from the retirement page: Entra ID > Authentication methods > Registration campaign. Set State to Microsoft Managed and target the security group of your SMS and voice users.
- For lost-phone recovery (section 5): in Entra ID > Authentication methods > Policies select Temporary Access Pass, select Enable, choose the users or groups, and Save.
Microsoft notes that on 2026-09-01 users enabled for SMS or voice were set to be auto-enabled for passkeys and nudged to register at their next MFA sign-in, with unlimited snoozes by default. A temporary opt-out exists for 2026-09-01 to 2027-02-01; Microsoft says there is no opt out for enforcement on the retirement date. Passkeys (FIDO2) are available in all Entra ID editions, including Free, per Microsoft. Steps: sources 2, 3, 4 below.
3. Three staff emails
Sample dates, chosen before 2027-02-01.
Email 1: notice, 2 November 2026
Subject: Changing how you sign in to Microsoft 365 before 1 February
Hi all,
Microsoft is ending the texted and phoned sign-in codes it provides for Microsoft 365 on 1 February 2027 (1 July 2027 for Global Administrators). After that date, anyone whose only sign-in method is a text or call will be asked to set up a passkey when they sign in, and can't skip that step.
A passkey lets you sign in with your phone's fingerprint, face or PIN instead of a code. Nothing to buy for most of you. The front desk and Grace will get a small USB security key.
What to do: nothing yet. On 7 December you'll get a one-page guide for your phone or PC. Questions: reply to this email.
Office manager, Example Accounting LLP
Email 2: how-to, 7 December 2026
Subject: Set up your passkey (10 minutes) - guide attached
Hi all,
Please set up your passkey this week using the attached one-page guide for your device (iPhone, Android or Windows). In short: sign in to Security info in your web browser, complete the sign-in, choose Add sign-in method, then Passkey, and follow the prompts.
Grace and the front desk: your security keys are on my desk. Come and get them and I'll show you in person.
If something goes wrong, reply with what you see on screen. Please don't send passwords or codes.
Office manager, Example Accounting LLP
Email 3: reminder, 18 January 2027
Subject: Reminder: passkey by 1 February
Hi all,
A reminder that texted sign-in codes for Microsoft 365 end on 1 February. If you haven't set up your passkey yet, please do it this week using the guide from 7 December (attached again). If you've already done it, you can ignore this.
If you've lost or replaced your phone, tell me and I'll set up a temporary way for you to sign in.
Office manager, Example Accounting LLP
4. Phone guide, summarised: iPhone
The full pack has this as a one-page guide with your firm's name and contact. Summary:
- Before you start, on the iPhone open Settings > General > AutoFill & Passwords. For Set Up Codes In, select Passwords.
- Open a web browser and sign in to Security info. Complete the sign-in.
- Tap + Add sign-in method, then Passkey, then Next. On iOS, tap Next again.
- Name your passkey and tap Next. When it's created, tap Done.
- Your passkey shows in Security info.
Android and Windows guides follow the same pattern with each device's own steps (the Android passkey provider setting is under Settings > Security and privacy > More security settings > Passwords, passkeys, and autofill, per Microsoft).
5. Lost-phone runbook
- The staff member tells the office manager. Nobody sends a password or code by email.
- Admin: sign in to the Microsoft Entra admin center as at least an Authentication Administrator. Browse to Entra ID > Users, select the user, select Authentication methods and Add authentication method, select Temporary Access Pass, set the activation time or duration, and select Add.
- Note the pass value shown; Microsoft says it can't be viewed again after you select OK. Give it to the user in person.
- The user opens Security info, enters their account name, enters the Temporary Access Pass, and registers a new passkey.
- Admin: remove the old passkey. In the admin center search for the user, select Authentication methods, right-click the old passkey and select Delete. Microsoft says people who update their methods after losing a device should remove the old ones.
Emergency admin ("break glass") account
- Microsoft's emergency access page recommends two or more emergency access accounts: cloud-only (*.onmicrosoft.com), with the Global Administrator role.
- It lists Passkey (FIDO2) as the recommended method, and says to use a method different from your normal admin accounts' (for example a FIDO2 security key if the admin uses Authenticator).
- It says to exclude them from any Conditional Access policy that blocks or restricts sign-in, and to validate the accounts at least every 90 days.
- Sample: two keys stored in two separate places in the office; the office manager and one partner know where.
6. Offboarding checklist
- When someone leaves, delete their passkeys: in the admin center search for the user, select Authentication methods, right-click each passkey and select Delete (Microsoft's documented way to remove a passkey from an account).
- Get back any FIDO2 security key issued to them and record where it is.
- If they used a shared account key (the front desk), tell the person responsible for that key that they've left.
- Check the plan table: remove or reassign their row.
- Your firm's usual steps for the account and mailbox apply after that; this pack covers sign-in methods only.
Order the real thing
US$249, nothing added, by email within 2 business days. Order by email Back to the offer
Microsoft sources used (all read 2026-10-14)
- https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement (dates, blocking prompt, registration campaign, auto-enablement)
- https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2 (passkey profiles, enable and target, synced passkeys, deleting a passkey)
- https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-register-passkey (iPhone and Android registration steps)
- https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass (Temporary Access Pass)
- https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-authenticator-passkey (Authenticator passkeys: Android 14+/iOS 17+)
- https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access (emergency access accounts)
- https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement-faq