Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice authentication

Updated October 26, 2026: We have updated the timeline. Thank you for your patience.  What and why Microsoft Entra ID is adding safeguards to reduce automated abuse of telephony-based authentication. SMS and voice authentication options are not being removed. Some users who use SMS or voice for first-factor sign-in may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before a code is sent. Rollout schedule Rollout began in mid-October 2026 and is ongoing.  Users may see an anti-bot verification step for first-factor telephony-based authentications. Impact on your organization Who is affected Some users who use SMS or voice as a first-factor sign-in method Platforms and services Microsoft Entra ID telephony-based authentication using SMS or voice for first-factor sign-in What will happen Some users might see an additional risk-based anti-bot verification step (CAPTCHA) before Microsoft sends the telephony code. The experience is determined based on client behaviors, so not every user or sign-in attempt will be affected. If the verification experience does not load because of restrictive network or firewall settings, affected users might not be able to complete the flow until required endpoints are allowed. Endpoint guidance is included in the linked documentation below. Action required and recommendations Prepare your help desk and user communications for the possibility of an anti-bot verification step before a telephony code is sent. Review the linked documentation for network-readiness guidance, including any approved endpoint or allowlist requirements. Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible. Learn more  Understanding telephony fraud risk for Microsoft Entra multifactor authentication - Microsoft Entra ID | Microsoft Learn Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in - Microsoft Entra ID | Microsoft Learn Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - Microsoft Entra ID | Microsoft Learn Compliance considerations No compliance considerations identified. Review as appropriate for your organization.