{
  "id": "CB-M365-AUTH-011",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-011",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-011.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-011.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-011",
    "title": "Disable SMS and voice call as authentication methods",
    "finding": {
      "title": "SMS or voice call can be used for authentication",
      "description": "Codes and calls sent to a phone number can be intercepted by SIM swapping, number porting or a phishing page, and give no protection against relay."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "mfa",
      "sms",
      "voice",
      "authentication-methods",
      "sim-swap"
    ],
    "description": "In the Authentication methods policy, the **SMS** and **Voice call** methods are disabled, or\nenabled only for a documented exception group (for example users waiting for a phishing-resistant\nmethod) with a removal date. The setting applies whatever telephony provider delivers the\nmessages: Microsoft until its retirement, then a third-party provider from the Microsoft\nSecurity Store.\n\nEmail one-time passcodes are handled separately in CB-M365-AUTH-012.\n",
    "rationale": "Phone methods depend on the mobile operator: SIM swap and number porting hand the codes to an\nattacker, and the code or call can be relayed by a phishing page like any other. SMS sign-in\nalso lets the phone number replace the password. Microsoft itself no longer considers these\nmethods secure and retires its own SMS and voice delivery in 2027.\n",
    "impact": "Users whose only method is a phone number lose MFA and SSPR. Identify them first\n(**User registration details**, method **SMS** or **Voice call**) and move them to Microsoft\nAuthenticator or a passkey. Users without a smartphone need a security key or a hardware OATH\ntoken.\n",
    "notes": "From 1 February 2027, Microsoft stops delivering SMS and voice for authentication (1 July 2027\nfor Global Administrators and external users); users who rely only on them are forced to\nregister a passkey. The control stays relevant for tenants that configure a third-party\ntelephony provider.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies**.\n3. Check that **SMS** and **Voice call** show **Enabled** = **No**, or target only a documented\n   exception group.\n4. Check that the migration is complete (CB-M365-AUTH-009); otherwise also check the\n   verification options in **Per-user MFA** > **service settings**.\n5. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `'Sms','Voice' | ForEach-Object { Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId $_ | Select-Object Id, State }`\n6. Fail if either method is enabled for all users or for an undocumented group.\n"
    },
    "remediation": {
      "manual": "1. List the users who still rely on SMS or voice and get them to register another method.\n2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n3. Browse to **Entra ID** > **Authentication methods** > **Policies** > **SMS**, turn\n   **Enable** off (or narrow the target to the exception group) and save.\n4. Do the same for **Voice call**.\nGraph equivalent: `Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId Sms -BodyParameter @{ '@odata.type' = '#microsoft.graph.smsAuthenticationMethodConfiguration'; state = 'disabled' }`\nand the same with `Voice` and `#microsoft.graph.voiceAuthenticationMethodConfiguration`.\n",
      "rollback": "Re-enable the method for a limited group only.\n"
    },
    "references": [
      {
        "title": "Passkeys by default and retirement of Microsoft-provided SMS and voice authentication",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-sms-voice-retirement",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Phone authentication methods in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-authentication-phone-options",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.3.5v2",
        "relation": "partial",
        "note": "SCuBA also disables email OTP; that part is CB-M365-AUTH-012, in the hardened profile."
      },
      {
        "framework": "anssi-mfa",
        "framework_version": "2.0",
        "id": "R8",
        "relation": "stricter",
        "note": "ANSSI rules out SMS; we also disable voice calls."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(8)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1111"
      },
      {
        "framework": "mitre-attack",
        "id": "T1557"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-009",
        "type": "requires"
      },
      {
        "id": "CB-M365-AUTH-012",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-013",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-040",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}