Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice multi-factor authentication

What and why Microsoft Entra ID is adding safeguards to protect telephony-based multifactor authentication (MFA) from automated fraudulent activity. Some users who use SMS or voice for MFA may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before Microsoft sends an SMS verification code or initiates a verification call. This change is separate from the planned retirement of SMS and voice authentication and does not affect the retirement timeline. Rollout schedule Worldwide: Beginning in mid-November 2026. Impact on your organization Who is affected Users who use SMS or voice for Microsoft Entra ID multifactor authentication Platforms and services Microsoft Entra ID SMS and voice authentication methods What will happen Some users may be prompted to complete a risk-based anti-bot verification step (CAPTCHA) before Microsoft sends an SMS verification code or initiates a verification call. The verification step will appear only for authentication attempts that meet sufficiently high-risk thresholds. Users with restrictive network or firewall settings may be unable to complete SMS or voice MFA if the verification experience cannot load. Action required and recommendations We recommend that administrators take the following actions: Prepare your help desk and notify users that some SMS and voice MFA attempts may require an additional CAPTCHA verification step. Review the risk-based anti-bot verification documentation for network-readiness guidance. If your organization uses restrictive firewalls, proxies, or web filtering, ensure that the required resources can load during authentication. Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible. Learn more Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - Microsoft Entra ID | Microsoft Learn Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in - Microsoft Entra ID | Microsoft Learn Understanding telephony fraud risk for Microsoft Entra multifactor authentication - Microsoft Entra ID | Microsoft Learn Compliance considerations No compliance considerations identified. Review as appropriate for your organization.