Microsoft Entra ID: Updates to SMS and voice verification experiences in MFA flows

Updated November 10, 2026: We have updated this post to ensure visibility for all impacted customers. The content below has not changed.

What and why

Microsoft Entra ID is updating SMS and voice verification experiences during multi-factor authentication (MFA) flows to show more secure verification methods first when they are available and to reduce unnecessary code sends. Telephony-based authentication methods are less secure than alternative authentication methods. SMS and voice are not being removed as part of this change and remain available by selecting Show more verification methods. First-factor authentication (1FA) flows are not affected by this change.

Rollout schedule

• Beginning in mid-October 2026 and expected to complete by late October 2026

Impact on your organization

Who is affected

• Users who have SMS or voice and at least one other non-telephony verification method available during an MFA flow

Platforms and services

• Microsoft Entra ID multi-factor authentication experiences that use SMS or voice verification

What will happen

• SMS and voice options are not being removed.
• If telephony is the only available method for the authentication flow, the experience remains unchanged.
• When users have SMS or voice plus at least one non-telephony verification method, Microsoft Entra ID will show the more secure non-telephony methods first.
• SMS or voice will remain available under Show more verification methods instead of appearing in the initial list.
• After a valid SMS or voice code is sent, users may need to wait a few minutes before another code can be sent.
• During the waiting period, users should wait for the code already requested to arrive. Previously sent codes remain valid.
• If the code does not arrive by the time the waiting period has passed, users can request another code using the same experience they use today.

Action required and recommendations

No configuration change is identified for this update. We recommend that you:

• Prepare your help desk for users who may see more secure verification methods shown before SMS or voice. SMS and voice remain available by selecting Show more verification methods.
• Be aware that the resend waiting period does not indicate an SMS or voice delivery failure. Codes can take a few minutes to arrive.
• If a code is not delivered as expected, review Troubleshoot MFA voice call and SMS problems. SMS and voice delivery can be affected by carrier routing, device or carrier blocking, regional availability, and other downstream telecom-provider issues.
• Review the Microsoft Entra multifactor authentication FAQ for additional information about Microsoft Entra multifactor authentication experiences.
• Separately, continue planning for the February 1, 2027 retirement of Microsoft-provided SMS and voice authentication for users in scope.
• Where possible, continue moving users toward phishing-resistant authentication methods such as passkeys (FIDO2). Passkeys provide phishing-resistant authentication based on FIDO standards.
• If your organization will continue to require SMS or voice authentication after February 1, 2027, evaluate Choose Your Own Telephony Provider as part of your planning.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.