The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled

Contributed by Michael Soule with Henrik PiechaAll contributors →

Part of CISA · Entra ID · Authentication methods · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.3.5

Overview

The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.

Rationale: SMS, voice call, and email OTP are the weakest authenticators. This policy forces users to use stronger MFA methods.

Remediation action:

If phishing-resistant MFA has not been deployed yet and Microsoft Authenticator is in use, configure Authenticator to display context information to users when they log in.

1. In Entra ID, click Security > Authentication methods
2. Click on the SMS, Voice Call, and Email OTP authentication methods and disable each of them. Their statuses should be Enabled > No on the Authentication methods > Policies page.

Related links

• Entra admin portal - Authentication methods
• CISA Strong Authentication & Secure Registration - MS.AAD.3.5v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.3.5
Severity	High
Suite	CISA
Product	Entra ID
Feature	Authentication methods
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1566.002 Spearphishing Link, T1621 Multi-Factor Authentication Request Generation, T1111 Multi-Factor Authentication Interception
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.3.5
Criticality	SHALL
Upstream requirement	MS.AAD.3.5v2
Supports controls	cisa-scuba:MS.AAD.3.5, nist-800-53-r5:CM-7b, nist-800-53-r5:IA-5c
PowerShell test	Test-MtCisaWeakFactor
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.3.5.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.3.5.md