SMS and Voice authentication methods are disabled

​

What this check verifies

Microsoft Entra tenant’s authentication methods policy should have SMS and Voice authentication methods disabled. These methods are vulnerable to SIM-swapping, interception, and social engineering attacks, and are deprecated by NIST SP 800-63B as out-of-band authenticators.

​

Risk

Enabled SMS or Voice authentication allows attackers to bypass MFA through SIM-swapping or SS7 protocol interception, gaining unauthorized access to accounts. These methods lack cryptographic binding to the device, making them significantly weaker than phishing-resistant alternatives.

​

Recommendation

Disable SMS and Voice authentication methods and adopt phishing-resistant alternatives such as FIDO2 security keys or Microsoft Authenticator. Use Authentication Strengths in Conditional Access policies to enforce only strong MFA methods across the tenant.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2. Go to Protection > Authentication methods > Policies
3. Select SMS and set its status to Disabled, then click Save
4. Select Voice call and set its status to Disabled, then click Save
5. Ensure users have alternative phishing-resistant MFA methods configured (e.g., FIDO2, Microsoft Authenticator)

​

References

• https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-phone-options
• https://pages.nist.gov/800-63-3/sp800-63b.html

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_authentication_method_sms_voice_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks