MC1518029 Low
Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice authentication
Summary AI-generated
Entra ID adds risk-based anti-bot CAPTCHAs to reduce telephony-based authentication abuse; some users may see extra verification before SMS/voice codes are sent.
Suggested actions AI-generated
- Prepare help desk and user communications for potential anti-bot verification step
- Review endpoint guidance and network requirements
- Move users to phishing-resistant authentication methods, such as passkeys
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1400824 (Updated) Microsoft Entra: Self-service password reset CAPTCHA protection updated
- MC1481309 Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection
- MC1426371 (Updated) Microsoft Entra: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
- MC1528000 Microsoft Entra ID: Reminder to migrate from Microsoft-provided SMS and voice authentication
- MC1191924 Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection
- MC1474104 Microsoft Entra ID: Follow-up on SMS first-factor sign-in retirement and upcoming changes
Original post from Microsoft
Updated October 26, 2026: We have updated the timeline. Thank you for your patience.
[What and why]
Microsoft Entra ID is adding safeguards to reduce automated abuse of telephony-based authentication. SMS and voice authentication options are not being removed. Some users who use SMS or voice for first-factor sign-in may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before a code is sent.
[Rollout schedule]
- Rollout began in mid-October 2026 and is ongoing.
- Users may see an anti-bot verification step for first-factor telephony-based authentications.
[Impact on your organization]
Who is affected
- Some users who use SMS or voice as a first-factor sign-in method
Platforms and services
- Microsoft Entra ID telephony-based authentication using SMS or voice for first-factor sign-in
What will happen
- Some users might see an additional risk-based anti-bot verification step (CAPTCHA) before Microsoft sends the telephony code.
- The experience is determined based on client behaviors, so not every user or sign-in attempt will be affected.
- If the verification experience does not load because of restrictive network or firewall settings, affected users might not be able to complete the flow until required endpoints are allowed. Endpoint guidance is included in the linked documentation below.
[Action required and recommendations]
- Prepare your help desk and user communications for the possibility of an anti-bot verification step before a telephony code is sent.
- Review the linked documentation for network-readiness guidance, including any approved endpoint or allowlist requirements.
- Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible.
Learn more
- Understanding telephony fraud risk for Microsoft Entra multifactor authentication - Microsoft Entra ID | Microsoft Learn
- Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in - Microsoft Entra ID | Microsoft Learn
- Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - Microsoft Entra ID | Microsoft Learn
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Additional details from Microsoft
- Summary
- Microsoft Entra ID is adding risk-based CAPTCHA verification for SMS and voice first-factor sign-ins to reduce automated abuse. Rollout began mid-October 2026. Some users may encounter this step based on behavior. Organizations should prepare help desks, review network requirements, and encourage phishing-resistant methods like passkeys.