MC1551151 - Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice multi-factor authentication

Microsoft 365 Message Center announcement MC1551151.

MS Message Center's Summary

Microsoft Entra ID is introducing risk based CAPTCHA verification for SMS and voice multi factor authentication starting in mid November 2026 to prevent automated fraud. Users deemed high risk will need to complete this verification step before receiving codes or calls. Administrators should prepare help desks, verify network readiness for CAPTCHA resources, and encourage migration to phishing resistant authentication methods.

Administrator impact
Administrators must review network configurations to ensure CAPTCHA resources load correctly and prepare support teams for user queries.
End user impact
Some users employing SMS or voice authentication may encounter a CAPTCHA prompt during high risk sign in attempts.
Importance
4/10: This update introduces new authentication prompts and network requirements that may affect users relying on telephony methods.

Passkeys by default and retirement of Microsoft provided SMS and voice authentication

Risk based anti bot verification for telephony based sign in

Understanding telephony fraud risk for Microsoft Entra multifactor authentication

Microsoft Summary

Starting mid-November 2026, Microsoft Entra ID will add risk-based CAPTCHA verification for SMS and voice MFA to prevent automated fraud. Some users may need to complete CAPTCHA before receiving codes or calls. Administrators should prepare users, ensure network readiness, and promote phishing-resistant methods.

Message Center ID
MC1551151
Category
prevent Or Fix Issue
Severity
normal
Services
Microsoft Entra
Tags
User impact, Admin impact
Published
2026-11-13
Last updated
2026-11-13
Expires
2026-12-30

[What and why] Microsoft Entra ID is adding safeguards to protect telephony-based multifactor authentication (MFA) from automated fraudulent activity. Some users who use SMS or voice for MFA may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before Microsoft sends an SMS verification code or initiates a verification call. This change is separate from the planned retirement of SMS and voice authentication and does not affect the retirement timeline. [Rollout schedule] Worldwide: Beginning in mid-November 2026. [Impact on your organization] Who is affected Users who use SMS or voice for Microsoft Entra ID multifactor authentication Platforms and services Microsoft Entra ID SMS and voice authentication methods What will happen Some users may be prompted to complete a risk-based anti-bot verification step (CAPTCHA) before Microsoft sends an SMS verification code or initiates a verification call. The verification step will appear only for authentication attempts that meet sufficiently high-risk thresholds. Users with restrictive network or firewall settings may be unable to complete SMS or voice MFA if the verification experience cannot load. [Action required and recommendations] We recommend that administrators take the following actions: Prepare your help desk and notify users that some SMS and voice MFA attempts may require an additional CAPTCHA verification step. Review the risk-based anti-bot verification documentation for network-readiness guidance. If your organization uses restrictive firewalls, proxies, or web filtering, ensure that the required resources can load during authentication. Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible. Learn more Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - Microsoft Entra ID | Microsoft Learn Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in - Microsoft Entra ID | Microsoft Learn Understanding telephony fraud risk for Microsoft Entra multifactor authentication - Microsoft Entra ID | Microsoft Learn [Compliance considerations] No compliance considerations identified. Review as appropriate for your organization.