What this check looks at
Checks whether the authentication methods policy still allows text message, voice call or email one-time codes as a way to sign in.
The Microsoft Entra authentication methods policy lists which methods people may use to sign in and complete MFA: Microsoft Authenticator, passkeys (FIDO2), Windows Hello for Business, Temporary Access Pass, and the older SMS (text message), Voice call and Email one-time passcode. Many tenants still have SMS and voice enabled from the days when they were the usual second factor.
This check reads the authentication methods policy. The check fails when text message (SMS) or voice call sign-in is enabled. If only email one-time passcode is enabled, it warns instead, at low severity. The evidence counts the people whose registered methods are all weak (phone numbers, email or security questions), who need something stronger set up first.
A code sent by text or call proves only that someone controls the phone number. SIM-swap and number-porting fraud (persuading a mobile network to move the number to the attacker’s SIM) intercepts it, and adversary-in-the-middle phishing pages simply ask the victim to type the code in and relay it within seconds. Email codes are only as safe as the mailbox they go to. Microsoft Authenticator with number matching resists most of this, and passkeys resist all of it.
Why it matters
Codes sent by text or call are taken over by SIM-swap fraud and relayed by phishing sites in real time; email codes are only as safe as the mailbox. Microsoft Authenticator, passkeys and security keys resist both, and every person who can use them is one less account an attacker can take over with a phone call to a mobile network.
The finance manager of a 25-person business uses text messages for MFA. Attackers who already have her password from a phishing page call her mobile network, pose as her and port her number to their SIM. They receive her code, sign in, add a mail rule hiding a supplier’s replies, and redirect a five-figure payment. The network restores her number two days later; the money is gone.
Moving people to Microsoft Authenticator is a short registration campaign, Microsoft itself advises moving away from phone-based methods, and for most staff the app is quicker than waiting for a text.
CIS Microsoft 365 Foundations Benchmark 5.2.3.5 (weak authentication methods disabled) and 5.2.3.7 (email OTP disabled), and CISA SCuBA MS.AAD.3.5 (SMS, voice call and email one-time passcode disabled) ask for exactly this. CIS Controls v8 safeguard 6.3, ISO 27001 A.8.5 (secure authentication), the NCSC CAF identity verification and authentication outcome and NIST CSF PR.AA-03 expect authentication strength to match the risk.
How to fix it
Where: Entra admin centre → Protection → Authentication methods → Policies
Before you start
- Check the evidence for people whose only second factor is a text or call; run the Microsoft Authenticator registration campaign for them first.
- Give anyone without a work phone a FIDO2 security key or a Temporary Access Pass to register one.
- Tell users what is changing and when, with a contact for problems.
Step by step
- Find who relies on weak methods. In the Microsoft Entra admin centre, go to Entra ID > Authentication methods > User registration details and filter Methods registered to show people with only Mobile phone, Office phone, Alternate mobile phone or Email. Compare with the number in the evidence and download the list.
- Run the Microsoft Authenticator registration campaign. Go to Entra ID > Authentication methods > Registration campaign and select Edit. Set State to Enabled, allow only one to three days of snoozing, and include All users (or the group of people from the first step), excluding the emergency access accounts. People who sign in with a phone method are then prompted to set up Microsoft Authenticator.
- Give alternatives to people without a smartphone. For anyone who cannot use the app, issue a FIDO2 security key and a Temporary Access Pass (Entra ID > Users > the user > Authentication methods > Add authentication method) so they can register the key at https://aka.ms/mysecurityinfo.
- Check password reset still works. Self-service password reset uses the same methods. Under Entra ID > Password reset > Authentication methods, check that Microsoft Authenticator is allowed for reset, so turning off text messages does not leave anyone without a way to reset their password.
- Turn off SMS and Voice call. When the list from the first step is empty or close to it, go to Entra ID > Authentication methods > Policies, open SMS, set Enable to off and Save; then do the same for Voice call.
- Turn off Email OTP. Open Email OTP in the same list and set Enable to off for members. Guests who sign in with an emailed code are covered by a separate guest setting under External Identities and are unaffected.
- Confirm the weak methods are off. Entra ID > Authentication methods > Policies should show SMS, Voice call and Email OTP as not enabled. User registration details should show nobody whose only methods are phone numbers or email, and new sign-ins (Authentication Details tab in the sign-in logs) should show no Text message or Voice call. The finding clears at the next assessment.
What users will notice
People who used a text or call are asked to approve in Microsoft Authenticator instead. Guests who sign in with an emailed code are unaffected.
How to confirm it worked
Entra ID, Protection, Authentication methods, Policies: SMS, Voice call and Email OTP show Enabled: No. User registration details should show nobody whose only method is a phone number.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-6 Use strong authentication controls |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 8.4.2 MFA for all access into the CDE |
| NIST SP 800-171 | 3.5.3 Use multi-factor authentication |
| CMMC Level 2 | IA.L2-3.5.3 Multifactor Authentication |
| ISO 27001:2022 | A.8.5 Secure authentication |
| CISA SCuBA | MS.AAD.3.5v2 SMS, voice call and email one-time passcode disabled |
| CIS M365 | 5.2.3.5 Ensure weak authentication methods are disabled5.2.3.7 Ensure the email OTP authentication method is disabled |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage authentication methods (Microsoft Learn)
- It’s time to hang up on phone transports (Microsoft Tech Community)