MWPRO IMPACT SCORE
OPERATIONAL IMPACT
58
0
25
50
75
100
HIGH IMPACT • REVIEW RECOMMENDED
Recommended Action:
Review the update and plan any required actions before rollout.
Review the update and plan any required actions before rollout.
What is MWPro Impact Score?
Watch our 60‑second explainer
Primary Audience
Tenant AdminsMicrosoft 365 AdminsSecurity TeamsIT ManagersService Owners
Why this score?
AI Confidence
HIGH
Enough detail is available to trust this assessment.
Assessment Reasoning
The rollout of risk-based CAPTCHA for SMS and voice authentication is active, with timeline confirmation in late October 2026. Admins must prepare support staff, validate network endpoints and communicate with users about the new verification prompt. User impact is moderate as this adds an extra step during sign-in for selected high-risk scenarios. Urgency and effort are moderate because rollout has begun and misconfigured network settings may block authentication until fixed.
65
Admin Impact
45
User Impact
60
Urgency
50
Effort
WHAT YOU NEED TO KNOW
AT A GLANCE
Entra ID now adds a risk-based CAPTCHA for SMS and voice authentication to reduce automated abuse. Some users may need to verify before receiving a code.
END USERS
Some users may see an anti-bot verification step before their SMS or voice code is sent.
IT ADMINS
Inform help desk teams and users about the new verification step and review network settings against Microsoft’s guidance.
ROLLOUT TIMELINE
Rolling out:
In progress
In progress
📢 Official Microsoft Message Center Announcement
Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice authentication
Message ID: MC1518029
Updated October 26, 2026: We have updated the timeline. Thank you for your patience.
[What and why]
Microsoft Entra ID is adding safeguards to reduce automated abuse of telephony-based authentication. SMS and voice authentication options are not being removed. Some users who use SMS or voice for first-factor sign-in may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before a code is sent.
[Rollout schedule]
- Rollout began in mid-October 2026 and is ongoing.
- Users may see an anti-bot verification step for first-factor telephony-based authentications.
[Impact on your organization]
Who is affected
- Some users who use SMS or voice as a first-factor sign-in method
Platforms and services
- Microsoft Entra ID telephony-based authentication using SMS or voice for first-factor sign-in
What will happen
- Some users might see an additional risk-based anti-bot verification step (CAPTCHA) before Microsoft sends the telephony code.
- The experience is determined based on client behaviors, so not every user or sign-in attempt will be affected.
- If the verification experience does not load because of restrictive network or firewall settings, affected users might not be able to complete the flow until required endpoints are allowed. Endpoint guidance is included in the linked documentation below.
[Action required and recommendations]
- Prepare your help desk and user communications for the possibility of an anti-bot verification step before a telephony code is sent.
- Review the linked documentation for network-readiness guidance, including any approved endpoint or allowlist requirements.
- Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible.
Learn more
- Understanding telephony fraud risk for Microsoft Entra multifactor authentication – Microsoft Entra ID | Microsoft Learn
- Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in – Microsoft Entra ID | Microsoft Learn
- Passkeys by default and retirement of Microsoft-provided SMS and voice authentication – Microsoft Entra ID | Microsoft Learn
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Source: Microsoft Message Center • Analysed by MWPro
