MC1518029 - Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice authentication

Microsoft 365 Message Center announcement MC1518029.

MS Message Center's Summary

Microsoft Entra ID is introducing risk based CAPTCHA verification for SMS and voice first factor sign ins to prevent automated abuse. The rollout started in October 2026 and continues through November 2026. Administrators should review network configurations to ensure verification endpoints are accessible, prepare support desks for user queries, and encourage the adoption of phishing resistant authentication methods like passkeys.

Administrator impact
Administrators must review network and firewall settings to ensure verification endpoints are accessible and prepare support desks for user inquiries.
End user impact
Certain users signing in with SMS or voice may encounter a CAPTCHA verification prompt before receiving their authentication code.
Importance
4/10: This change introduces a new user interface step for telephony sign ins and requires network checks to prevent authentication failures.

Understanding telephony fraud risk for Microsoft Entra multifactor authentication

Risk based anti bot verification for telephony based sign in

Passkeys by default and retirement of Microsoft provided SMS and voice authentication

Microsoft Summary

Microsoft Entra ID is adding risk-based CAPTCHA verification for SMS and voice first-factor sign-ins to reduce automated abuse. Rollout began mid-October 2026. Some users may encounter this step based on behavior. Organizations should prepare help desks, review network requirements, and encourage phishing-resistant methods like passkeys.

Message Center ID
MC1518029
Category
prevent Or Fix Issue
Severity
normal
Services
Microsoft Entra
Tags
Updated message, User impact, Admin impact
Published
2026-10-20
Last updated
2026-10-29
Expires
2026-11-30

Updated October 26, 2026: We have updated the timeline. Thank you for your patience. [What and why] Microsoft Entra ID is adding safeguards to reduce automated abuse of telephony-based authentication. SMS and voice authentication options are not being removed. Some users who use SMS or voice for first-factor sign-in may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before a code is sent. [Rollout schedule] Rollout began in mid-October 2026 and is ongoing. Users may see an anti-bot verification step for first-factor telephony-based authentications. [Impact on your organization] Who is affected Some users who use SMS or voice as a first-factor sign-in method Platforms and services Microsoft Entra ID telephony-based authentication using SMS or voice for first-factor sign-in What will happen Some users might see an additional risk-based anti-bot verification step (CAPTCHA) before Microsoft sends the telephony code. The experience is determined based on client behaviors, so not every user or sign-in attempt will be affected. If the verification experience does not load because of restrictive network or firewall settings, affected users might not be able to complete the flow until required endpoints are allowed. Endpoint guidance is included in the linked documentation below. [Action required and recommendations] Prepare your help desk and user communications for the possibility of an anti-bot verification step before a telephony code is sent. Review the linked documentation for network-readiness guidance, including any approved endpoint or allowlist requirements. Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible. Learn more Understanding telephony fraud risk for Microsoft Entra multifactor authentication - Microsoft Entra ID | Microsoft Learn Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in - Microsoft Entra ID | Microsoft Learn Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - Microsoft Entra ID | Microsoft Learn [Compliance considerations] No compliance considerations identified. Review as appropriate for your organization.