Summary
Microsoft Entra ID is adding risk-based CAPTCHA verification for SMS and voice first-factor sign-ins to reduce automated abuse. Rollout began mid-October 2026. Some users may encounter this step based on behavior. Organizations should prepare help desks, review network requirements, and encourage phishing-resistant methods like passkeys.
Message ID: MC1518029
Last Updated: Oct 29, 2026
Published Oct 20, 2026
Service: Microsoft Entra
Tag: Updated message, User impact, Admin impact
Updated October 26, 2026: We have updated the timeline. Thank you for your patience.
Microsoft Message
Microsoft Entra ID is adding safeguards to reduce automated abuse of telephony-based authentication. SMS and voice authentication options are not being removed. Some users who use SMS or voice for first-factor sign-in may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before a code is sent.
Rollout schedule
- Rollout began in mid-October 2026 and is ongoing.
- Users may see an anti-bot verification step for first-factor telephony-based authentications.
Impact on your organization
Who is affected
Some users who use SMS or voice as a first-factor sign-in method
Platforms and services
Microsoft Entra ID telephony-based authentication using SMS or voice for first-factor sign-in
What will happen
- Some users might see an additional risk-based anti-bot verification step (CAPTCHA) before Microsoft sends the telephony code.
- The experience is determined based on client behaviors, so not every user or sign-in attempt will be affected.
- If the verification experience does not load because of restrictive network or firewall settings, affected users might not be able to complete the flow until required endpoints are allowed. Endpoint guidance is included in the linked documentation below.
Action required and recommendations
- Prepare your help desk and user communications for the possibility of an anti-bot verification step before a telephony code is sent.
- Review the linked documentation for network-readiness guidance, including any approved endpoint or allowlist requirements.
- Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible.
Learn more
- Understanding telephony fraud risk for Microsoft Entra multifactor authentication – Microsoft Entra ID | Microsoft Learn
- Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in – Microsoft Entra ID | Microsoft Learn
- Passkeys by default and retirement of Microsoft-provided SMS and voice authentication – Microsoft Entra ID | Microsoft Learn
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.