EIDSCA.AS04: Authentication Method - SMS - Use for sign-in.
| ID | EIDSCA.AS04 |
| Severity | High |
| Suite | EIDSCA |
| Product | Entra ID |
| Feature | Authentication methods |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:CM-7 Least Functionalitynist-800-53-r5:IA-5 Authenticator Management |
| MITRE ATT&CK | T1111, T1566.002 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Determines if users can use this authentication method to sign in to Microsoft Entra ID. true if users can use this method for primary authentication, otherwise false.
Avoid to use SMS as primary sign in factor (instead of a password) and consider to implement a MFA or passwordless option also for your special user groups, such as front-line workers.
Test script
Section titled “Test script”https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('Sms').includeTargets.isUsableForSignIn -eq 'false'Remediation action
Section titled “Remediation action”Microsoft Learn - Configure and enable users for SMS-based authentication using Microsoft Entra ID
Related links
Section titled “Related links”- Open in Graph Explorer
- phoneAuthenticationMethod resource type - Microsoft Graph v1.0 | Microsoft Learn
Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.