Updated October 26, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Entra ID is adding safeguards to reduce automated abuse of telephony-based authentication. SMS and voice authentication options are not being removed. Some users who use SMS or voice for first-factor sign-in may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before a code is sent.
Rollout schedule
- Rollout began in mid-October 2026 and is ongoing.
- Users may see an anti-bot verification step for first-factor telephony-based authentications.
Impact on your organization
Who is affected
- Some users who use SMS or voice as a first-factor sign-in method
Platforms and services
- Microsoft Entra ID telephony-based authentication using SMS or voice for first-factor sign-in
What will happen
- Some users might see an additional risk-based anti-bot verification step (CAPTCHA) before Microsoft sends the telephony code.
- The experience is determined based on client behaviors, so not every user or sign-in attempt will be affected.
- If the verification experience does not load because of restrictive network or firewall settings, affected users might not be able to complete the flow until required endpoints are allowed. Endpoint guidance is included in the linked documentation below.
Action required and recommendations
- Prepare your help desk and user communications for the possibility of an anti-bot verification step before a telephony code is sent.
- Review the linked documentation for network-readiness guidance, including any approved endpoint or allowlist requirements.
- Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible.
Learn more
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.