- Security
- Entra ID
- Copilot
- Microsoft 365
A look at the distant future of Microsoft 365, far beyond the Message Center
Four Microsoft 365 changes with a date, from 2026 to 2035, explained without jargon: goodbye to SMS codes, identities for AI agents, overshared files and post-quantum cryptography.
Microsoft 365 is changing under the hood, and hardly anyone notices. The changes arrive in technical notices that few people read.
Here we translate them into plain language. There are four, and they come down to one idea: protect who gets in and what they can see.
None of it is science fiction. Every change has a date.
- Passkeys become the default way to sign in to Microsoft 365.
- An AI agent can no longer create new identities without an administrator's approval.
- Microsoft stops sending SMS and voice calls for identity verification.
- The same applies to Global Administrators and guest users.
- Microsoft plans to have its first quantum-resistant protections available.
- Microsoft expects to finish moving its products and services.
- Deadline set by most governments.
The identity changes arrive within months. The post-quantum transition is measured in years, but it starts now.
1. Quantum computers and today's email
In one sentence: what is safely locked away today could be opened in a few years.
Your email and files travel locked with a mathematical padlock. No current computer can break it. A large quantum computer, once it exists, will.
The attackers' trick is simple: copy now, open later. It's like stealing a safe you can't open today and waiting for someone to sell the key.
The answer is new padlocks, built for those machines. Microsoft is already adding them to its products and expects to finish by 2033, two years ahead of the deadline most governments have set.
Your part: know which of your information will still be sensitive in ten years. Microsoft takes care of the rest.
2. AI gets its own employee badge
In one sentence: AI assistants will work in your company, and they'll need the same oversight as any employee.
More and more tasks will be done by AI agents: finding documents, answering email, preparing reports. Microsoft already gives each one its own identity, like an employee badge.
With that badge you can see what each agent does, give it only the permissions it needs and take them away when it no longer does. Microsoft is also tightening the rules: from 4 November 2026, an agent can no longer create new identities on its own unless an administrator approves it.
Your part: know which agents you have, what they can touch and who owns each one. An agent without an owner is a risk.
3. AI sees everything you can see
In one sentence: if a file is shared wrongly, AI will find it.
Picture a payroll file shared with the whole company by mistake. Before, nobody found it. Now it's enough to ask Copilot, because it searches everything each person has permission to see.
Microsoft offers tools in Purview to find these files and mark sensitive documents with labels such as "Confidential". With those labels you can, for example, stop Copilot from summarising a confidential document.
But finding the problem isn't fixing it. Someone has to review the permissions and correct them.
Your part: sort out who can see what before giving your staff more AI.
4. Goodbye to SMS codes
In one sentence: the SMS code you get to sign in to Microsoft 365 is on its way out.
An SMS can be intercepted, or someone can trick you into reading it out. That's why Microsoft is replacing it with passkeys: you sign in with your fingerprint, face or phone PIN, with no code anyone can copy. They've been the default since September 2026, and on 1 February 2027 Microsoft stops sending the SMS. Anyone who still needs them will have to bring their own telephony provider.
Your part: move your users to passkeys before that date, calmly, not in a rush on a Monday morning.
What to do today
It all comes down to one idea: know what you have, who gets in and what they can see. Five steps to start:
- Check who still signs in with SMS and move them to passkeys.
- List your AI agents and give each one an owner.
- Review which folders and files are overshared.
- Label your most sensitive documents.
- Write down which information must stay protected in ten years' time.
The future is configured today
You don't have to do it all at once. You do have to start before the changes arrive on their own.
At dForts we follow Microsoft 365 news every week and turn it into clear steps for our clients. If you want to know where your company stands, let's talk.
Frequently asked questions
- What happens if my users still rely on SMS on 1 February 2027?
- They will stop receiving the code, unless your organisation has set up its own telephony provider through the Microsoft Security Store. Microsoft recommends having it configured at least four weeks before. For Global Administrators and guest users the change arrives on 1 July 2027. The simplest path is to move them to passkeys first.
- What is a passkey and how much does it cost?
- It's a credential stored on your phone, your computer or a security key that you unlock with your fingerprint, face or PIN. There's no code to copy, so tricking someone into handing it over doesn't work. It's included in every Microsoft Entra plan at no extra cost.
- How do I know which AI agents my company has?
- Since May 2026, Copilot Studio creates a Microsoft Entra identity for every new agent, and you can review them in the Microsoft Entra admin center. Applying Conditional Access or ID Protection to them requires Microsoft Agent 365 or Microsoft 365 E7.
- Do I need to do anything about quantum computing now?
- Microsoft takes care of its own services. Your part is to identify which information must stay secret for ten years or more (contracts, R&D, health data) and to ask the vendors of your custom software what their plan is.