October is Cybersecurity Awareness Month, and this year it comes with a deadline that affects almost every business running Microsoft 365. On February 1, 2027, Microsoft stops delivering the text-message and phone-call codes many employees still use to sign in. The best way to mark the month isn’t a poster in the break room. It’s spending October making sure the basics are actually in place, starting with that change.
Here’s a practical checklist for Baton Rouge businesses, built around this year’s national themes.
This year’s themes, in plain English
The campaign is led by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance. CISA’s 2026 theme is “Securing the Next 250,” built around three actions it calls the 3Rs: reduce your attack surface, replace devices that no longer get security updates, and be ready to recover. The Alliance’s theme, “Don’t Make It Easy for Them,” focuses on four everyday habits: strong passwords with a password manager, multi-factor authentication, recognizing and reporting scams, and keeping software updated.
Both themes come down to the same idea. Attackers look for the easy way in, so don’t leave one open.
Your October checklist
1. Get your team off text-message and phone-call sign-in codes
This is the one with a date on it. Microsoft is retiring the SMS and voice codes it provides for multi-factor authentication in Microsoft 365 work accounts. Since September 1, users who rely on those methods have been prompted to set up a passkey. Starting February 1, 2027, anyone whose only sign-in method is a text or phone call will be stopped at sign-in and required to register a passkey before they can get into their account. Global administrators and external users follow on July 1, 2027.
Text-message codes were never the strongest option. They can be intercepted or phished. Moving everyone to an authenticator app or a passkey now means February 1 is a normal Monday instead of a morning of locked-out employees.
2. Confirm MFA covers every account, not just most
One account without multi-factor authentication is enough for an attacker. Check for shared mailboxes, service accounts and older email connections that skip MFA, and make sure your policies are actually enforcing, not just running in test mode. (We explain why that matters in how we prove managed IT is working.)
3. Give everyone a password manager
If employees reuse passwords, one breach at some other website becomes a breach at yours. A business password manager makes strong, unique passwords the easy choice, and lets you share credentials safely instead of over email or sticky notes.
4. Replace what no longer gets security updates
This is CISA’s “replace.” Microsoft ended support for Windows 10 in October 2025, so any computer still running it isn’t receiving security fixes. The same goes for old firewalls, routers and servers past their end-of-support date. Make a list, then budget to replace them on your technology roadmap.
5. Close doors nobody is using
This is “reduce.” Remove accounts for former employees, take away administrator rights people don’t need day to day, and turn off remote access that’s open to the internet without protection. Every unused door is one attackers can try.
6. Test a restore, not just a backup
This is “recover,” and it’s the one most businesses can’t prove. A backup that reports success every night still has to be restored to know it works. Pick an important folder or system and restore it this month. If you don’t know how, that’s your answer. (More on why this matters in our post on ransomware and small businesses.)
7. Give your team a 15-minute scam refresher
Phishing emails are better written than they used to be, and AI has made fake voices and urgent “it’s the boss” requests easier to fake. Walk your team through a couple of real examples, and make reporting a suspicious message easy and blame-free. The person who reports a mistake quickly is helping you.
8. Check your cyber insurance answers before renewal
If your insurance application says you have MFA on every account, tested backups and endpoint protection, make sure that’s still true. A wrong answer can put a claim at risk. Here’s how to check your application against reality.
9. Know which AI tools can see your data
AI tools that connect to your Microsoft 365 account can read email and files. Review which ones have access, and make sure your team knows what they can and can’t paste into them. Connected apps can be a risk even when they aren’t AI, as this month’s cloud backup breach showed. Our AI acceptable use policy guide covers what to include.
How we’re handling this for our clients
For our managed clients, most of this list is already part of how we work. Every environment is reviewed against our 94 written standards, covering MFA, patching, end-of-support devices, backups and AI tools, with evidence behind every answer. We’re also moving our clients’ users off text-message and phone-call codes ahead of Microsoft’s deadline, so nobody discovers the change at sign-in on February 1. You can see the full scope on our cybersecurity services page.
Frequently asked questions
Will my employees be locked out on February 1, 2027?
Not completely, but they’ll be interrupted. Anyone whose only multi-factor method is a text or phone call will have to register a passkey at sign-in before they can continue. For a business that hasn’t prepared, that means a morning of confused employees and help desk calls. Moving people over in advance avoids it.
Can we keep using text-message codes?
Only by contracting with a separate telecom provider, which Microsoft offers through its Security Store for organizations with a specific need. For most small businesses, moving to an authenticator app or passkeys is simpler and more secure.
Does this affect personal Microsoft accounts?
This change applies to work accounts in Microsoft Entra ID, which is what Microsoft 365 business accounts use.
What is Cybersecurity Awareness Month?
It’s an annual campaign every October, led by CISA and the National Cybersecurity Alliance, to help individuals and organizations take practical steps to stay safe online.
Make October count
If you’re not sure how many of your employees still rely on text-message codes, or how the rest of this checklist looks for your business, let’s walk through it together. Schedule a 15-minute discovery call, or call us at (225) 351-0775, Monday through Friday, 8 AM to 5 PM.
