I have had SMS disabled in Azure for Authentication, yet users were recently found to STILL BEING ABLE TO USE IT???

Question

I have had SMS disabled in Azure for Authentication, yet users were recently found to STILL BEING ABLE TO USE IT???

Dalton Reeves 146

So what the hell is this about, it is CLEARLY disabled in Azure for my tenant, yet users were found over the last couple days to still be able to use SMS and weren't using the authenticator app for MFA. The hell is the point of turning something off if this stupid platform doesn't honor it?

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-30T21:15:48.5633333+00:00
Hello Dalton Reeves,

I understand why this is frustrating.

Even if SMS is disabled in Microsoft Entra ID, it can still show up in some cases, like if per-user MFA is still enabled, Conditional Access isn’t restricting methods, or users are on existing sessions.

Could you check:

SMS is disabled in Authentication Methods

Per-user MFA isn’t enabled

Conditional Access or authentication strengths block SMS

Also, have affected users sign out and back in.

If it’s still happening, please share screenshots of the policy and the MFA prompt so we can see what’s allowing it.
Dalton Reeves 146 Reputation points

2026-04-30T21:19:55.36+00:00

CA has been enforcing MFA for apps for years, and SMS has been turned off for at least 1.5 years. It is absolutely stupid that with those settings made in the way that it still works. Microsoft "who calls themself a security company" is a joke with this. It's all fine now, i've fixed the issue -- but I shouldn't have had to do what I did to eliminate it. Why the hell would that option be there if it doesn't really do anything. So freaking stupid, man I hate Microsoft and their bs illogical ways. If some is not enabled IT SHOULDN'T WORK. About as dumb as their enabled disabled not-configured crap.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-30T21:25:00.5966667+00:00

Hello Dalton Reeves,

I understand this is frustrating, especially when you already turned it off and still see it working.

In Microsoft Entra ID, disabling SMS in Authentication Methods doesn’t always block it everywhere. It can still be used if things like per-user MFA or old sessions are still active, which makes it look like the setting isn’t working.

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-30T21:15:48.5633333+00:00

Hello Dalton Reeves,

I understand why this is frustrating.

Even if SMS is disabled in Microsoft Entra ID, it can still show up in some cases, like if per-user MFA is still enabled, Conditional Access isn’t restricting methods, or users are on existing sessions.

Could you check:

SMS is disabled in Authentication Methods

Per-user MFA isn’t enabled

Conditional Access or authentication strengths block SMS

Also, have affected users sign out and back in.

If it’s still happening, please share screenshots of the policy and the MFA prompt so we can see what’s allowing it.
Dalton Reeves 146 Reputation points

2026-04-30T21:19:55.36+00:00

CA has been enforcing MFA for apps for years, and SMS has been turned off for at least 1.5 years. It is absolutely stupid that with those settings made in the way that it still works. Microsoft "who calls themself a security company" is a joke with this. It's all fine now, i've fixed the issue -- but I shouldn't have had to do what I did to eliminate it. Why the hell would that option be there if it doesn't really do anything. So freaking stupid, man I hate Microsoft and their bs illogical ways. If some is not enabled IT SHOULDN'T WORK. About as dumb as their enabled disabled not-configured crap.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-30T21:25:00.5966667+00:00

Hello Dalton Reeves,

I understand this is frustrating, especially when you already turned it off and still see it working.

In Microsoft Entra ID, disabling SMS in Authentication Methods doesn’t always block it everywhere. It can still be used if things like per-user MFA or old sessions are still active, which makes it look like the setting isn’t working.

Answer 1

Several behaviors in Microsoft Entra ID can explain why users are still seeing or using SMS even after it appears to be disabled:

Legacy MFA vs. Authentication methods policy

The legacy MFA settings (per-user or “service settings”) and the newer Authentication methods policy are separate.
SMS and voice have multiple controls in the legacy policy (SMS, Phone calls, Mobile phone, Office phone). In the Authentication methods policy, SMS and Voice calls are separate methods with their own enable/disable and targeting settings.
If SMS is enabled in any applicable policy (for example, enabled for a specific group in the Authentication methods policy, or still allowed via legacy “Mobile phone”), users in scope can still use SMS.
During migration, if SSPR or other features still have Mobile phone or SMS enabled, SMS can remain available even if it looks disabled in one place.

“Use for sign-in” and SMS sign-in vs. MFA

The Authentication methods policy has a Use for sign-in option on SMS. By default, this is enabled when SMS is turned on.
If SMS sign-in is enabled for users, they can be prompted for SMS codes as part of sign-in, even if the intent was to restrict them to Microsoft Authenticator.
If cross-tenant synchronization or other constraints are in play, SMS sign-in may be automatically skipped for some users but still available for others.

System-preferred MFA behavior

With system-preferred multifactor authentication enabled (the Microsoft-managed default), the platform chooses the most secure registered method but still allows users to choose another registered method.
If users have both Microsoft Authenticator and SMS registered, system-preferred MFA will prompt with Authenticator first, but users can still switch to SMS unless SMS is fully disabled or removed as a registered method.

Existing registrations vs. policy changes

Disabling a method in policy does not automatically delete users’ previously registered phone numbers or methods; it prevents future use according to scope.
If the method remains enabled for some groups or via legacy settings, users who already registered SMS can continue to use it.

To enforce Authenticator and stop SMS use:

Verify that SMS and Voice calls are disabled or not targeted to users in the Authentication methods policy.
Ensure legacy MFA settings (including Mobile phone and Phone calls) are aligned with the new policy.
Confirm system-preferred MFA is enabled and that Microsoft Authenticator is enabled for all users, while SMS is disabled or restricted to only those who truly need it.
Remove or update users’ SMS registrations where necessary so they cannot fall back to SMS even if previously registered.

References: