How to block "Phone call approval" and "Text message" authentication methods in Entra ID

Question

I would like to allow only Microsoft Authenticator as second authentication factor in my tenant.

I have set the options in Authentication methods | Policies accordingly, but users are still able to authenticate with "Phone call approval" and "Text message" authentication methods.

What do I need to do in order to prevent that?

Answer 1

Hello Tilman Schmidt,

Please ensure that you have migrated from legacy authentication methods to modern authentication methods. If not, I recommend completing the migration by following the documentation below, as this must be done by September 30, 2025.

How to migrate MFA and SSPR policy settings to the Authentication methods policy for Microsoft Entra ID

Once you migrate to the modern authentication methods policy, disable all non-usable methods and enable only Microsoft Authenticator. This will ensure that users can complete MFA exclusively with the Microsoft Authenticator app.

If you still need more time to migrate and do not want users to perform MFA with SMS or voice call, you can disable these methods in the legacy settings as well: Microsoft Entra ID > Users > Per-user MFA > Service Settings > Verification options → disable Call to phone and Text message to phone.

At the same time, make sure to disable these methods in the modern authentication methods policy too.