Microsoft to Drop SMS Auth for Xbox and Personal Accounts

Microsoft is phasing out SMS authentication and account recovery for personal Microsoft accounts worldwide, including Xbox profiles linked to those accounts.

The company said the change is already underway and that affected users should review their account security settings to ensure alternative sign-in and recovery options are in place.

Microsoft attributed the change to rising fraud tied to SMS codes, calling SMS-based authentication “a leading source of fraud.” In a statement, the company wrote: “SMS authentication is vulnerable to phishing and SIM-swap attacks. We’re replacing it with passkeys and verified email for better protection and convenience. Passkeys are a modern, phishing-resistant way to sign in using your device’s built-in authentication (like Face ID, fingerprint, or PIN). They’re faster and more secure than passwords or SMS codes.”

Microsoft recommends three main alternatives for signing in and account recovery: passkeys that use a device’s biometric or PIN features, a verified email address, and the Microsoft Authenticator app. The company said app-based two-factor prompts and verified email recovery will continue to function.

Recent updates to Microsoft account sign-in add support for passkeys with device biometric authentication. The company pointed to support pages and the Security section of the Microsoft account dashboard for step-by-step instructions on enabling passkeys, adding a verified email or installing the Authenticator app.

Microsoft noted the change follows incidents of account takeovers that have led some users to lose access to purchased digital libraries. The company advised users who already use passwordless sign-in and two-factor authentication that they should experience minimal disruption as SMS options are removed.