# Authentication Method Policy - SMS

> Send a one-time code via SMS to a user's mobile phone for authentication.

Send a one-time code via SMS to a user's mobile phone for authentication. SMS can be configured for both password reset and sign-in purposes. Enabling "use for sign-in" allows users to authenticate using their phone number and SMS verification code.

## Settings this baseline controls

| Setting        | What it does                                                                                                                                                                                |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Method enabled | Specifies whether SMS authentication method is enabled or disabled for the tenant. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/smsauthenticationmethodconfiguration) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline turns SMS sign-in off tenant-wide. Add it to the tenant, or through a scheme, anywhere you want to retire text-message codes in favour of stronger methods.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Turn **Method enabled** off. SMS codes can be intercepted or redirected by a SIM-swap attack, so the baseline recommends against relying on them.
3. Save. Turn on **Auto-remediation** if you want Octiga to switch it back off whenever someone re-enables it in Microsoft Entra.

> **Caution:** Some users may have SMS as their only registered sign-in or password-reset method, and would lose the ability to sign in or reset their own password. Before you disable SMS, check who uses it and get them registered on [Authentication Method Policy - Microsoft Authenticator](https://docs.octiga.io/baselines/access-management/authentication-methods-microsoft-authenticator/) or another method.

## Check it worked

Passing means **Entra ID → Authentication methods → Policies → SMS** shows the method disabled. Anyone who used to get a text-message code is prompted for a different registered method the next time they sign in or reset a password.

## Standards this addresses

### CIS

- **M365 5.2.3.x** — CIS M365 Foundations Benchmark 5.2.3.x
- **v8 6.3** — CIS Controls v8 Safeguard 6.3

### NIST

- **PR.AC-7** — NIST CSF 2.0 PR.AC-7
- **IA-5** — NIST SP 800-53 IA-5

### ISO 27001

- **A.8.3.3** — ISO/IEC 27001:2022 Annex A.8.3.3

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)