Back to Checks
m365

SMS and Voice authentication methods are disabled in the tenant

entra_authentication_method_sms_voice_disabled
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra tenant's authentication methods policy should have SMS and Voice authentication methods disabled. These methods are vulnerable to SIM-swapping, interception, and social engineering attacks, and are deprecated by NIST SP 800-63B as out-of-band authenticators.

Prowler logoProwlerprowler-provider-m365

Risk

Enabled SMS or Voice authentication allows attackers to bypass MFA through SIM-swapping or SS7 protocol interception, gaining unauthorized access to accounts. These methods lack cryptographic binding to the device, making them significantly weaker than phishing-resistant alternatives.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_authentication_method_sms_voice_disabled

Recommendation

Disable SMS and Voice authentication methods and adopt phishing-resistant alternatives such as FIDO2 security keys or Microsoft Authenticator. Use Authentication Strengths in Conditional Access policies to enforce only strong MFA methods across the tenant.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Protection** > **Authentication methods** > **Policies**
3Select **SMS** and set its status to **Disabled**, then click **Save**
4Select **Voice call** and set its status to **Disabled**, then click **Save**
5Ensure users have alternative phishing-resistant MFA methods configured (e.g., FIDO2, Microsoft Authenticator)

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_authentication_method_sms_voice_disabled(Check):
    """
    Ensure that SMS and Voice authentication methods are disabled in Microsoft Entra.

    This check verifies that the tenant's authentication methods policy has both SMS and
    Voice methods disabled, as they are vulnerable to SIM-swapping, interception, and
    social engineering attacks. NIST SP 800-63B deprecates SMS as an out-of-band
    authenticator.

    - PASS: Both SMS and Voice authentication methods are disabled.
    - FAIL: SMS and/or Voice authentication methods are enabled.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the SMS and Voice authentication method check.

        Evaluates the authentication method configurations from the Entra client
        and checks whether both SMS and Voice methods are disabled.

        Returns:
            A list with a single report containing the result of the check.
        """
        findings = []
        configs = entra_client.authentication_method_configurations

        sms_config = configs.get("Sms")
        voice_config = configs.get("Voice")

        if sms_config or voice_config:
            sms_enabled = sms_config and sms_config.state == "enabled"
            voice_enabled = voice_config and voice_config.state == "enabled"

            report = CheckReportM365(
                metadata=self.metadata(),
                resource=sms_config or voice_config,
                resource_name="SMS and Voice Authentication Methods",
                resource_id=entra_client.tenant_domain,
            )

            if sms_enabled and voice_enabled:
                report.status = "FAIL"
                report.status_extended = (
                    "SMS and Voice authentication methods are enabled in the tenant."
                )
            elif sms_enabled:
                report.status = "FAIL"
                report.status_extended = (
                    "SMS authentication method is enabled in the tenant."
                )
            elif voice_enabled:
                report.status = "FAIL"
                report.status_extended = (
                    "Voice authentication method is enabled in the tenant."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    "SMS and Voice authentication methods are disabled in the tenant."
                )

            findings.append(report)

        return findings

References