What it decides

Rule
ENTRA-METHOD-001
Applies to
entra · authentication-methods-policy
Default severity
medium
Basis
documented-guidance

On what authority

Microsoft states it plainly: "SMS and voice are no longer positioned as secure authentication methods and will no longer be provided natively in Entra ID." The schedule is published rather than implied -- passkeys become the default experience from 1 September 2026, and Microsoft-provided telecom delivery for SMS and voice is retired from 1 February 2027, after which an organisation that still needs them configures a customer-managed provider. AN ANNOUNCED CHANGE IS A SOURCE OF A RULE, not an afterthought to one. This engine's own source hierarchy says so: a reference page describes what the product does today and says nothing about what it is about to stop doing, and a tenant reading `enabled` here is reading a value whose meaning has an expiry the page does not carry. Separately and for longer, Microsoft has recommended moving away from these methods -- "Microsoft recommends users move away from using text messages or voice calls for multifactor authentication" -- so this is guidance with a date attached rather than a threshold this engine invented.

What it needs to decide

  • authentication_methods_policy.method_sms

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated

What a pass does not establish

A pass says the method is not enabled in the policy. It does not say what anybody is registered for, which is a different surface and a different read: a tenant may disable SMS here and still hold users whose only registered method was SMS.

  • Voice call is a separate method with a separate state and its own rule. A pass here says nothing about it.
  • This reads the tenant-wide state of the method. The policy can target a method at named groups, and the state alone does not say who is in scope.
  • An enabled method is not one anybody authenticates with. Whether anybody does is established by the registration and sign-in surfaces, and neither is read here.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.