We are experiencing an issue with MFA via SMS in our tenant

Question

We are experiencing an issue with MFA via SMS in our tenant. Users are able to add a phone number to their security info, but when attempting to actually use SMS for MFA, the authentication fails.

From the Sign-in / Authentication methods logs, we can see the following details:

Method: Text message (SMS)

Failure reason: Multi-factor authentication method is blocked

Result detail: BadReputation

We confirmed that:

SMS is enabled in the Authentication Methods policy for all users.

The affected accounts do not have legacy per-user MFA enabled.

Conditional Access is set to “Require MFA” (not “Authentication strength”).

Request: Could you please investigate why this tenant’s SMS number is blocked with “BadReputation”?

If this is due to a false positive or regional issue, we’d like Microsoft to review and, if possible, clear the block so SMS MFA can be used successfully.

Answer 1

Hello

Thank you for your reply, the problem is that all my users are having that authentication error when trying to use SMS, they can login with the authenticator app, or phone call, but with SMS, they cannot. This is new started happening since August, 6, 2026.

I have some users that refuses to use the authenticator app, because they use personal phones and don't want o download the application.

I can reset authentication methods, but cannot do it for all users, it will be a disaster.

Answer 2

Hi Rios,

Thank you for taking the time to provide the details.

From what you've shared, the error"BadReputation" typically indicates that Microsoft's telephony fraud and reputation systems have blocked the SMS authentication attempt or the associated phone number.

Just to gently clarify, as a fellow user, I don't have access to your tenant, user accounts, authentication logs, or Microsoft's internal systems. Because of this, I'm unable to investigate the cause of the "BadReputation" status, verify whether a phone number has been blocked by Microsoft's telephony reputation systems, or make any changes to remove such a block.

To help restore access, I recommend the following steps:  

---

1/ Contact your IT department

If the affected accounts are end-user accounts, please reach out your organization's IT admins and share the guidance provided in the article Manage user authentication methods for Microsoft Entra multifactor authentication. This will help them review and reset your authentication methods, which may restore access to the accounts.

In case you do not know who your IT admin is, kindly refer to this article: How do I find my Microsoft 365 admin? - Microsoft Support.

---

2/ If one of the affected accounts is the only administrator in the tenant 

In this situation, the Microsoft Data Protection Team has tools and processes in place to verify identity and regain access to administrator accounts.

Your admin can then try reaching out to the Global Customer Service phone to raise a request for resetting your authentication method here: Customer service phone numbers - Microsoft Support. (Work account)

During the phone call, your admin will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify their identity and securely assist in regaining access to the administrator account.

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help your admin prepare:

(When calling the support number, there may be an introduction of about 30 seconds such as "you can visit the link...". Please ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)

In some countries, it is an automated conversation like:

IVR: What kind of problem are you concerned about?

You: Loss of access.

IVR: What kind of product do you use?

You: Office 365 for business.

IVR confirmation: education or company account?

You: For companies

IVR: Are you an administrator?

You: Yes.

IVR: Do you have another administrator in your organization?

You: No.

IVR: Do you need a... Service request?

You: Yes. I need to create a ticket. Please send me directly to the Data Protection Team.

I hope the information provided helps guide you in the right direction. Although I’m unable to take direct action, I sincerely hope that the steps and recommendations I’ve shared can support you through the process.

---

If the answer is helpful, please click "Yes". If you have any extra questions about this answer, please click "Comment".  

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.