cirsec Baselines
Esc
Microsoft 365 tenant · Identity & authentication

Disable SMS and voice call as authentication methods

When it fails: SMS or voice call can be used for authentication. Codes and calls sent to a phone number can be intercepted by SIM swapping, number porting or a phishing page, and give no protection against relay.

CB-M365-AUTH-011mediumactivemanualprofile baseline

Description

In the Authentication methods policy, the SMS and Voice call methods are disabled, or enabled only for a documented exception group (for example users waiting for a phishing-resistant method) with a removal date. The setting applies whatever telephony provider delivers the messages: Microsoft until its retirement, then a third-party provider from the Microsoft Security Store.

Email one-time passcodes are handled separately in CB-M365-AUTH-012.

From 1 February 2027, Microsoft stops delivering SMS and voice for authentication (1 July 2027 for Global Administrators and external users); users who rely only on them are forced to register a passkey. The control stays relevant for tenants that configure a third-party telephony provider.

Rationale

Phone methods depend on the mobile operator: SIM swap and number porting hand the codes to an attacker, and the code or call can be relayed by a phishing page like any other. SMS sign-in also lets the phone number replace the password. Microsoft itself no longer considers these methods secure and retires its own SMS and voice delivery in 2027.

Impact

Users whose only method is a phone number lose MFA and SSPR. Identify them first (User registration details, method SMS or Voice call) and move them to Microsoft Authenticator or a passkey. Users without a smartphone need a security key or a hardware OATH token.

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to Entra ID > Authentication methods > Policies.
  3. Check that SMS and Voice call show Enabled = No, or target only a documented exception group.
  4. Check that the migration is complete (CB-M365-AUTH-009); otherwise also check the verification options in Per-user MFA > service settings.
  5. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): 'Sms','Voice' | ForEach-Object { Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $_ | Select-Object Id, State }
  6. Fail if either method is enabled for all users or for an undocumented group.

Remediation

  1. List the users who still rely on SMS or voice and get them to register another method.
  2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
  3. Browse to Entra ID > Authentication methods > Policies > SMS, turn Enable off (or narrow the target to the exception group) and save.
  4. Do the same for Voice call. Graph equivalent: Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId Sms -BodyParameter @{ '@odata.type' = '#microsoft.graph.smsAuthenticationMethodConfiguration'; state = 'disabled' } and the same with Voice and #microsoft.graph.voiceAuthenticationMethodConfiguration.

Rollback

Re-enable the method for a limited group only.

References

Mappings

FrameworkIDRelationNote
ANSSI - Recommandations relatives à l'authentification multifacteur et aux mots de passe2.0R8stricterANSSI rules out SMS; we also disable voice calls.
NIST SP 800-53 Rev. 55.1.1IA-5related
NIST SP 800-53 Rev. 55.1.1IA-2(8)related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.3.5v2partialSCuBA also disables email OTP; that part is CB-M365-AUTH-012, in the hardened profile.

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1111
MITRE ATT&CKT1557

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr