Authentication Method Policy - SMS

Send a one-time code via SMS to a user’s mobile phone for authentication. SMS can be configured for both password reset and sign-in purposes. Enabling “use for sign-in” allows users to authenticate using their phone number and SMS verification code.

Settings this baseline controls

Setting	What it does
Method enabled	Specifies whether SMS authentication method is enabled or disabled for the tenant. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline turns SMS sign-in off tenant-wide. Add it to the tenant, or through a scheme, anywhere you want to retire text-message codes in favour of stronger methods.

1. Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).

2. Turn Method enabled off. SMS codes can be intercepted or redirected by a SIM-swap attack, so the baseline recommends against relying on them.

3. Save. Turn on Auto-remediation if you want Octiga to switch it back off whenever someone re-enables it in Microsoft Entra.

Caution

Some users may have SMS as their only registered sign-in or password-reset method, and would lose the ability to sign in or reset their own password. Before you disable SMS, check who uses it and get them registered on Authentication Method Policy - Microsoft Authenticator or another method.

Check it worked

Passing means Entra ID → Authentication methods → Policies → SMS shows the method disabled. Anyone who used to get a text-message code is prompted for a different registered method the next time they sign in or reset a password.

Standards this addresses

CISM365 5.2.3.xv8 6.3

NISTPR.AC-7IA-5

ISO 27001A.8.3.3

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→