Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice multi-factor authentication

Starting mid-November 2026, Microsoft Entra ID will add risk-based CAPTCHA verification for SMS and voice MFA to prevent automated fraud. Some users may need to complete CAPTCHA before receiving codes or calls. Administrators should prepare users, ensure network readiness, and promote phishing-resistant methods. Microsoft Entra ID is adding safeguards to protect telephony-based multifactor authentication (MFA) from automated fraudulent activity. Some users who use SMS or voice for MFA may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before Microsoft sends an SMS verification code or initiates a verification call. This change is separate from the planned retirement of SMS and voice authentication and does not affect the retirement timeline. Rollout schedule Worldwide: Beginning in mid-November 2026. Impact on your organization Who is affected Users who use SMS or voice for Microsoft Entra ID multifactor authentication Platforms and services Microsoft Entra ID SMS and voice authentication methods What will happen Some users may be prompted to complete a risk-based anti-bot verification step (CAPTCHA) before Microsoft sends an SMS verification code or initiates a verification call. The verification step will appear only for authentication attempts that meet sufficiently high-risk thresholds. Users with restrictive network or firewall settings may be unable to complete SMS or voice MFA if the verification experience cannot load. Action required and recommendations We recommend that administrators take the following actions: Prepare your help desk and notify users that some SMS and voice MFA attempts may require an additional CAPTCHA verification step. Review the risk-based anti-bot verification documentation for network-readiness guidance. If your organization uses restrictive firewalls, proxies, or web filtering, ensure that the required resources can load during authentication. Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible. Learn more Passkeys by default and retirement of Microsoft-provided SMS and voice authentication – Microsoft Entra ID | Microsoft Learn Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in – Microsoft Entra ID | Microsoft Learn Understanding telephony fraud risk for Microsoft Entra multifactor authentication – Microsoft Entra ID | Microsoft Learn Compliance considerations No compliance considerations identified. Review as appropriate for your organization. Message ID: MC1551151

The post Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice multi-factor authentication appeared first on M365 Admin.