Posted inMicrosoft Entra

MC1551151: Microsoft Entra ID Adds Risk-Based CAPTCHA Verification for SMS and Voice Multi-Factor Authentication

3 minutesPosted inMicrosoft Entra
MWPRO IMPACT SCORE
OPERATIONAL IMPACT
58
0 25 50 75 100
HIGH IMPACT • REVIEW RECOMMENDED
Recommended Action:
Review the update and plan any required actions before rollout.
▶ What is MWPro Impact Score? Watch our 60‑second explainer

Primary Audience

Tenant AdminsMicrosoft 365 AdminsSecurity TeamsIT ManagersService Owners
Why this score?
AI Confidence
HIGH
Enough detail is available to trust this assessment.
Assessment Reasoning
This is a new Microsoft Entra ID security enhancement introducing risk-based CAPTCHA for SMS and voice MFA from mid-November 2026. Admins need to prepare support teams and ensure network configurations allow CAPTCHA to load. User impact will be moderate as CAPTCHA only appears for high-risk authentication attempts. Urgency and effort are moderate since preparation and communication are needed before the feature activates.
65
🛡️ Admin Impact
HIGH
45
👥 User Impact
MEDIUM
60
⚡ Urgency
HIGH
50
🔧 Effort
HIGH
ℹ️ WHAT YOU NEED TO KNOW
📌

AT A GLANCE

Entra ID adds a CAPTCHA check to stop bots abusing SMS and voice MFA. Some users will see this extra step when risk is high.
👥

END USERS

Some users may need to complete a CAPTCHA before receiving an SMS code or voice call.
🛡️

IT ADMINS

Notify users and help desk about the new CAPTCHA step. Check firewalls and proxies allow the verification to load.
📅

ROLLOUT TIMELINE

Start:
Mid-November 2026

📢 Official Microsoft Message Center Announcement

Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice multi-factor authentication
Message ID: MC1551151

[What and why]

Microsoft Entra ID is adding safeguards to protect telephony-based multifactor authentication (MFA) from automated fraudulent activity. Some users who use SMS or voice for MFA may be asked to complete a risk-based anti-bot verification step (CAPTCHA) before Microsoft sends an SMS verification code or initiates a verification call.

This change is separate from the planned retirement of SMS and voice authentication and does not affect the retirement timeline.

[Rollout schedule]

  • Worldwide: Beginning in mid-November 2026.

[Impact on your organization]

Who is affected

  • Users who use SMS or voice for Microsoft Entra ID multifactor authentication

Platforms and services

  • Microsoft Entra ID
  • SMS and voice authentication methods

What will happen

  • Some users may be prompted to complete a risk-based anti-bot verification step (CAPTCHA) before Microsoft sends an SMS verification code or initiates a verification call.
  • The verification step will appear only for authentication attempts that meet sufficiently high-risk thresholds.
  • Users with restrictive network or firewall settings may be unable to complete SMS or voice MFA if the verification experience cannot load.

[Action required and recommendations]

We recommend that administrators take the following actions:

  • Prepare your help desk and notify users that some SMS and voice MFA attempts may require an additional CAPTCHA verification step.
  • Review the risk-based anti-bot verification documentation for network-readiness guidance. If your organization uses restrictive firewalls, proxies, or web filtering, ensure that the required resources can load during authentication.
  • Continue moving users to phishing-resistant authentication methods, such as passkeys, where possible.

Learn more

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.

Source: Microsoft Message Center • Analysed by MWPro

Tags: