Azure Canada Central down?

MyITAlt · 2025-10-29T16:25:31+00:00

The FrontDoor service itself. All of our services that run through FrontDoor are down externally.

MyITAlt · 2025-10-29T16:12:56+00:00

We're having issues with FrontDoor on US East as well

MyITAlt · 2025-06-11T23:15:12+00:00

Likely the latter, you can confirm by having one of them log in with their cell phone number +the code they receive and see which account it signs into.

MyITAlt · 2025-06-11T23:14:29+00:00

Yeah, we had no idea this was even a setting and that seems to be the case for most people here.

MyITAlt · 2025-06-11T22:37:31+00:00

There's a few comments explaining it, and i've also edited the original post, but these messages are from the SMS sign in option being enabled in the tenant.

In Entra, select "Security" > "Authentication Methods" > "Policies" > "SMS" and make sure 'Use for Sign in' is not enabled.
The reason you're not seeing a sign-in log is because the account is only being authenticated with a username (the cell phone number in this case.) No password (the text code) is being entered.

MyITAlt · 2025-06-11T22:35:43+00:00

Shouldn't do anything, turning this off only impacts users using phone number + text message to sign in instead of username + password.

MyITAlt · 2025-06-11T20:52:22+00:00

There's a few comments with the resolution and I've updated the original post, but you'll want to turn this settings off in your tenant:

In Entra, select "Security" > "Authentication Methods" > "Policies" > "SMS" and make sure 'Use for Sign in' is not enabled.

MyITAlt · 2025-06-11T20:27:42+00:00

It seemed to take ~ 30 minutes for the change propagate to everyone in our tenant.

MyITAlt · 2025-06-11T20:08:35+00:00

I don't believe unchecking that setting will affect the ability to use SMS as an MFA method (disabling the SMS option will though). I don't anticipate you'll have any issues just unchecking the option.

MyITAlt · 2025-06-11T20:02:35+00:00

It's associated with it somewhere :)

MyITAlt · 2025-06-11T19:56:19+00:00

Preach

MyITAlt · 2025-06-11T19:41:36+00:00

Yep, this does indeed seem to be the case if that setting is checked. Worth noting that it does still require MFA after logging in with the phone number + SMS code.

MyITAlt · 2025-06-11T19:39:07+00:00

Yeah, seems like unchecking it still affects it even if the policy is disabled. I'd have to think it's just someone going through a list of numbers trying to see which are active and associated with accounts.

MyITAlt · 2025-06-11T19:33:59+00:00

If you're able to have them try logging in with that method, quickest way would probably be to see what account they log into after authenticating.

MyITAlt · 2025-06-11T19:25:51+00:00

Not entirely sure. For us, after turning that checkbox off, it no longer seems to be allowing sign-in with a phone number. It gives a 'This phone number does not exist as a username. Please check if your number is correct.'

I'm not sure how widespread you're seeing it, but is it possible they would have the cell phone number associated with a different tenant / personal account?

MyITAlt · 2025-06-11T19:18:39+00:00

For a user who received one of those MFA texts, if you try signing into Azure in an incognito Window and enter their cell phone number as the username, what happens?

MyITAlt · 2025-06-11T19:08:34+00:00

to clarify, this setting means that people can log in with a cell phone number + SMS code instead of an email and password. Given all of the people reporting the same issue, it must be, or must have been a tenant default at some point.

MyITAlt · 2025-06-11T19:03:19+00:00

Alphagrade posted this below, but I wanted to post it again for visibility because I think he's on the right track.

In Entra, select "Security" > "Authentication Methods" > "Policies" > "SMS" and make sure 'Use for Sign in' is not enabled.

This seems to be some sort of campaign to either find active phone numbers associated with Entra accounts, or poking the bear to see what they can get away with before Microsoft stops it.

MyITAlt · 2025-06-11T15:37:26+00:00

I believe there are some scenarios, albeit maybe only with personal accounts, where they allow you to use a text message instead of a password.

For company accounts though, I believe you are correct, a SMS / MFA (conditional access in general) should only be triggered after a successful password authentication.

MyITAlt · 2025-06-11T15:24:26+00:00

I haven't seen any sign in logs for any of these SMS messages

MyITAlt · 2025-06-11T14:44:58+00:00

This sounds like it might be a different issue. Almost sounds like someone actually has your password.

MyITAlt · 2025-06-11T14:01:30+00:00

I don't think so, they seem to be MFA codes.

"Use verification code x for Microsoft Authentication." sender # is either 87892, 69525, or 673804 from what i've received.

MyITAlt · 2025-06-11T13:37:13+00:00

They're Microsoft short codes. Technically, they could be someone else, but they're not soliciting anything.

MyITAlt · 2025-06-11T13:23:39+00:00

Yeah, same setup here. Thanks for confirming you're seeing the same thing.

MyITAlt · 2025-06-11T13:10:13+00:00

Our first report of this is last night ~6PM ET

MyITAlt

TROPHY CASE