SMS authentication code is sent to Whatsapp instead SMS. How do we block this?

Microsoft Entra does not provide a separate control to block only WhatsApp delivery; to prevent it while retaining MFA, move users from phone text verification to Microsoft Authenticator or another enabled authentication method.

Microsoft treats SMS, RCS, and WhatsApp as delivery channels for the same text message verification method. Only users who have WhatsApp associated with their registered phone number can receive codes there. If WhatsApp is unavailable—for example, it is uninstalled or the device has no Internet connectivity—Entra falls back to SMS. Users should also receive an SMS notification the first time delivery changes to WhatsApp.^1^

Why this started

Microsoft initially used WhatsApp for Entra MFA codes in India and Indonesia in late 2023. Starting in December 2024, it re-enabled the channel in India and expanded it to additional countries, citing improved delivery and completion rates.^2^

The channel is selected by the Microsoft delivery service; the documented Entra controls do not include a separate Disable WhatsApp option.

Ways to prevent WhatsApp delivery

For an individual user who must retain SMS

• Uninstall WhatsApp from the phone associated with the registered authentication number, or make WhatsApp unavailable.
• Request another code. Entra should fall back to regular SMS.^1^

This is a device-level workaround, not an administrator-enforced policy.

For an organization that must prohibit WhatsApp

Disable phone text verification and require a different MFA method:

1. Register Microsoft Authenticator or another permitted method for affected users before disabling text verification, to avoid locking them out.
2. Sign in to the Microsoft Entra admin center with at least the Authentication Policy Administrator role.
3. Go to Entra ID → Users → Per-user MFA.
4. Select Service settings at the top.
5. Under Verification options, clear the text-message option.
6. Select Save.^3^

This disables text verification as a whole, including SMS, RCS, and WhatsApp; it cannot preserve SMS while centrally excluding only WhatsApp. Microsoft recommends moving away from text and voice authentication in favor of modern methods such as Microsoft Authenticator.^1^

If text verification must remain available for operational or regulatory reasons, there is currently no documented tenant setting that guarantees SMS only. The practical choices are device-level WhatsApp removal or migration away from the phone text-message method.

References

1. Authentication methods in Microsoft Entra ID - Voice call
2. Archive for Microsoft Entra releases and announcements
3. Configure Microsoft Entra multifactor authentication settings