An account already has Microsoft Authenticator and another authenticator app configured as its default sign-in methods. SMS and voice-call MFA are being phased out, but a phone number still appears to remain available as a recovery or authentication option. SMS is disabled in the tenant's authentication-method settings, while voice calls are enabled only for a specific group. What additional settings or policies are needed to completely remove these legacy phone-based methods from the account and tenant?
2 Answers
A phone number can remain visible because it is used for account recovery or as a registered security method, even when SMS authentication is disabled. Treat recovery settings separately from normal MFA methods, and check the account-recovery configuration along with per-user authentication methods. Phone-based recovery is generally a weaker fallback than an authenticator app or another phishing-resistant method.
Review the tenant’s Authentication methods policy and explicitly disable both SMS and voice calls for every applicable user group. Also check whether the phone number is present as a user’s authentication method or security contact, since disabling a method at the tenant level may not automatically delete numbers that were already registered. Remove those stored methods from the affected accounts as well.
That distinction helps. SMS is already disabled globally, but I’ll check the specific user registrations and the recovery configuration, since the remaining phone number may not be controlled by the same policy.