What and why
Microsoft Entra ID is adding safeguards to protect telephony-based multifactor authentication (MFA) from automated fraudulent activity. Some users who use SMS or voice for MFA may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before Microsoft sends an SMS verification code or initiates a verification call.
This change is separate from the planned retirement of SMS and voice authentication and does not affect the retirement timeline.
Rollout schedule
- Worldwide: Beginning in mid-November 2026.
Impact on your organization
Who is affected
- Users who use SMS or voice for Microsoft Entra ID multifactor authentication
Platforms and services
- Microsoft Entra ID
- SMS and voice authentication methods
What will happen
- Some users may be prompted to complete a risk-based anti-bot verification step (CAPTCHA) before Microsoft sends an SMS verification code or initiates a verification call.
- The verification step will appear only for authentication attempts that meet sufficiently high-risk thresholds.
- Users with restrictive network or firewall settings may be unable to complete SMS or voice MFA if the verification experience cannot load.
Action required and recommendations
We recommend that administrators take the following actions:
- Prepare your help desk and notify users that some SMS and voice MFA attempts may require an additional CAPTCHA verification step.
- Review the risk-based anti-bot verification documentation for network-readiness guidance. If your organization uses restrictive firewalls, proxies, or web filtering, ensure that the required resources can load during authentication.
- Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible.
Learn more
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.