SMS and voice methods should be disabled because they are easy targets for phishing, SIM swap attacks, and call-forwarding abuse. They also create a weaker fallback that attackers can exploit when stronger methods are unavailable. Replace them with stronger approved methods, confirm break-glass access, and monitor sign-ins for any residual use of these channels.
Why SMS and voice methods become the weak link in Entra ID sign-in
SMS and voice are weak because they rely on channels that attackers can redirect, intercept, or socially engineer. In Entra ID, that makes them attractive fallback methods rather than strong proof of possession. Once a weaker method remains enabled, it can become the easiest route into an account when users, help desks, or recovery flows cannot use stronger authenticators.
They are also operationally fragile. A phone number is not the same thing as a device-bound authenticator, and it can be moved, forwarded, or hijacked outside the identity system. That means the security decision is not just about the method itself, but about the trust you are placing in the telecom channel and the recovery path attached to it.
To choose the right replacement, compare the method against phishing-resistant MFA rather than against convenience. If a method can be relayed, forwarded, or intercepted without device binding, it should not be treated as a strong sign-in factor for privileged or high-value access.
What attack paths make SMS and voice risky in practice?
SMS and voice are exposed to phishing, SIM swap attacks, call-forwarding abuse, and other forms of social engineering because the attacker only needs to seize the channel, not the underlying account. In Entra ID environments, that means the method can fail even when the password is still protected, because the second factor is what gets bypassed.
The bigger problem is fallback abuse. If users can still authenticate with SMS or voice after stronger methods are enrolled, attackers often target the weakest remaining option first. That pattern shows up repeatedly in real compromises, including breaches where weak or legacy MFA paths were the door into cloud identity and downstream systems.
For a concrete example of how phishing of one-time codes can cascade into tenant exposure, see Twilio 0ktapus breach 2022. For broader identity hardening context, Active Directory and Entra ID Hardening Guide ties method choice to privileged access and recovery design rather than to enrollment convenience.
How should organisations phase them out without breaking recovery?
The practical goal is not to remove every phone-based path blindly, but to remove weak sign-in methods while preserving a tightly controlled recovery design. Strong methods should be the default for normal authentication, while break-glass and emergency access paths should be separately governed, tested, and monitored so that disabling SMS and voice does not strand administrators during an incident.
In rollout terms, start with privileged users, administrators, and high-risk groups, then move to the wider workforce once recovery and exception handling are verified. If you need a migration path, use approved phishing-resistant methods and make sure account recovery does not quietly reintroduce the same weak channel you just removed.
Use Passwordless and Passkeys Guide to anchor the replacement strategy, especially where you need a clean route from SMS and voice to passkeys or FIDO2. If you are designing workforce-wide adoption rather than a single hardening change, Workforce Identity Security Guide is the better operational reference because it covers rollout, recovery, and exception handling together.
Risk and Threat Considerations
Leaving SMS or voice enabled creates a standing fallback that attackers can aim at when stronger methods are unavailable or inconvenient. That raises the chance of account takeover through channel hijacking, phone-number reassignment, or social engineering against telecom or support workflows.
Failure mechanism: The attacker does not need to break the primary password or enroll a new authenticator if they can intercept or redirect the backup channel and use it to satisfy the second factor.
Impact: The compromise can bypass the intended MFA strength, expose privileged sessions, and give the attacker a path into cloud services, email, admin consoles, or downstream applications that trust the Entra ID sign-in.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Phishing-resistant authenticators and assurance levels directly govern MFA method strength. |
| Recommendation — Prefer phishing-resistant authenticators and phase out weaker SMS or voice sign-in methods. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | SMS and voice are authenticator lifecycle choices that affect issuance, use, and retirement. |
| IA-2 — Identification and Authentication (Organizational Users) | The question concerns employee and admin sign-in assurance in Entra ID. | |
| Recommendation — Retire weak authenticators and manage approved factors through their full lifecycle. Require stronger authentication for users who access enterprise resources. | ||
| OWASP ASVS | V6 — Authentication | ASVS authentication requirements align with rejecting weak second factors and preferring stronger methods. |
| Recommendation — Adopt stronger authentication requirements and avoid weak fallback factors. | ||
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | Fallback channels and shared recovery paths can create human-driven misuse of identity controls. |
| Recommendation — Prevent users from relying on weak shared recovery paths that weaken assurance. | ||
Practitioner Guidance
What to verify: Confirm that SMS and voice are disabled for normal sign-in, but also check whether they still exist in recovery, self-service reset, or exception paths. A method that is disabled at sign-in but still usable for account recovery can remain an effective attack path.
Decision rule: If a user or admin can reach production access through a phone-number channel alone, treat that as a compensating weakness, not as a tolerated convenience. Keep a separate, tested break-glass process and monitor every use of the remaining legacy path.
What good looks like: Strong methods are the default, emergency access is explicitly controlled, and residual SMS or voice usage is visible enough to investigate quickly. The control is working when the weak methods are absent from day-to-day authentication and any reappearance is deliberate, rare, and reviewable.
Practitioner takeaway: Disable SMS and voice because they are not just less convenient, they are materially easier to redirect or abuse, so the real security gain comes from removing them as fallback authentication while preserving a separate, verified recovery design.
Related resources from NHI Mgmt Group
- How do you detect changes to user authentication methods in Microsoft Entra ID?
- How do you manage authentication methods in Microsoft Entra ID?
- How do you migrate to the authentication methods policy in Microsoft Entra ID?
- How do you protect authentication methods in Microsoft Entra ID from tampering?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org