MC1465763 - Microsoft Entra: Prepare for Microsoft to disable unused or unsuccessful SMS first-factor sign-in

What and why

You are receiving this message because SMS first-factor sign-in is enabled in your Microsoft Entra tenant.

Microsoft has observed significant fraud activity targeting SMS first-factor sign-in. SMS is a phishing-susceptible authentication method, and leaving this capability enabled can create risk even when users are not actively or successfully using it.

SMS first-factor sign-in allows users, such as frontline workers, to sign in using only a registered phone number and a one-time passcode (OTP) sent by SMS, without entering a username or password.

SMS first-factor sign-in does not enforce multifactor authentication (MFA).

To help protect customers, users, and Microsoft services, Microsoft will automatically disable SMS first-factor sign-in in tenants that meet either of the following conditions:

• No successful SMS first-factor sign-in activity has occurred during the previous 30 days.
• All SMS first-factor sign-in attempts during the previous 30 days were unsuccessful.

This change affects only SMS as a first-factor sign-in method. Users can continue to receive SMS verification codes for multifactor authentication (MFA) and Self-Service Password Reset (SSPR).

We strongly recommend that you review this setting and recent SMS first-factor sign-in activity before rollout begins. If your organization still requires SMS first-factor sign-in, confirm that legitimate users can sign in successfully and ensure that they have another sign-in method registered.

Rollout schedule

• Worldwide: Beginning in mid-September 2026 and expected to complete by late September 2026

During rollout, Microsoft will evaluate eligible tenants and disable SMS first-factor sign-in when the criteria described above are met.

Impact on your organization

Who is affected

• Organizations with SMS first-factor sign-in enabled in Microsoft Entra
• Tenants with no SMS first-factor sign-in activity during the previous 30 days
• Tenants where all SMS first-factor sign-in attempts during the previous 30 days were unsuccessful
• Users who rely exclusively on SMS first-factor sign-in

Platforms and services

• Microsoft Entra ID
• SMS first-factor passwordless sign-in (SignInNoPassword)
• Microsoft Entra authentication methods policies

What will happen

• Microsoft will review recent SMS first-factor sign-in activity in eligible tenants.
• If no successful SMS first-factor sign-in activity occurred during the previous 30 days, Microsoft will clear the Use for sign-in setting.
• If all SMS first-factor sign-in attempts during the previous 30 days were unsuccessful, Microsoft will clear the Use for sign-in setting.
• Clearing Use for sign-in disables SMS first-factor sign-in for the tenant.
• Users will no longer be able to use SMS as their only authentication factor for sign-in.
• Users who rely exclusively on SMS first-factor sign-in must register and use another sign-in method.
• SMS verification codes for MFA and SSPR will continue to work.
• Other authentication methods, including password-based sign-in, are not affected.

Action required and recommendations

Review your Microsoft Entra authentication methods policy to determine whether SMS first-factor sign-in is intentionally enabled and still required.

Before rollout begins, we recommend that you:

• Review SMS first-factor sign-in activity from the previous 30 days.
• Identify users who currently rely on SMS first-factor sign-in.
• Investigate unsuccessful SMS first-factor sign-in attempts.
• Ensure affected users have at least one alternate sign-in method registered.
• Communicate this change to affected users before rollout.
• Migrate users to passkeys or another phishing-resistant authentication method where possible.
• Disable SMS first-factor sign-in yourself if your organization no longer requires it.

To review or disable SMS first-factor sign-in:

• Sign in to the Microsoft Entra admin center with an account assigned at least the Authentication Policy Administrator role.
• Go to Entra ID > Authentication methods > Policies.
• Select SMS from the list of available authentication methods.
• Locate Use for sign-in under SMS-based authentication.
• Clear Use for sign-in to disable SMS first-factor sign-in.
• Save the policy.

Clearing Use for sign-in stops SMS first-factor sign-in. It does not prevent users from using SMS for MFA or SSPR.

Learn more

• Configure and enable users for SMS-based authentication using Microsoft Entra ID | Authentication | Microsoft Entra | Microsoft Learn

Compliance considerations