Regions requiring opt-in for SMS verification (preview)

Applies to: Workforce tenants External tenants (learn more)

To safeguard against telephony fraud, Microsoft disallows traffic from certain phone number country codes. Doing so helps prevent unauthorized access and protect customers from fraudulent activities such as International Revenue Share Fraud (IRSF). With IRSF, criminals gain unauthorized access to a network and divert traffic to premium rate numbers, resulting in exorbitant charges and making it harder for your customers to access your services. Learn more.

When a country code is blocked, customers trying to set up SMS verification for multifactor authentication (MFA) for your application might encounter the message "Try another verification method." To resolve this issue, you can activate telephony traffic for the specific country code for your application.

You can use the Microsoft Graph API onPhoneMethodLoadStart event policy to manage telephony traffic for apps in your external tenant. With this event policy, you can activate or deactivate country codes for specific countries and regions.

Country codes requiring opt-in

Starting January 2025, the following country codes will be deactivated by default for SMS verification. If you want to allow traffic from deactivated regions, you need to activate them using the onPhoneMethodLoadStartevent policy.

Table 1. SMS verification country codes requiring opt-in

Manage telecom for regions with Microsoft Graph

Use the OnPhoneMethodLoadStartExternalUsersAuthHandler event policy to activate or deactivate country codes.

Table 2. Properties of OnPhoneMethodLoadStartExternalUsersAuthHandler

How to activate telecom for regions

To enable telephony traffic from currently deactivated country codes, use the Microsoft Graph API to set the includeAdditionalRegions property in the onPhoneMethodLoadStart event policy for one or more applications. Include the relevant country codes in the includeAdditionalRegions property of the API request body for the regions you want to activate. For example, to send SMS requests in South Asia, activate the numeric country codes for the five countries within that region.

Example REST APIs

POST https://graph.microsoft.com/v1.0/identity/authenticationEventListeners  
{  
    "@odata.type": "#microsoft.graph.onPhoneMethodLoadStartListener",  
    "conditions": {  
        "applications": {  
            "includeApplications": [  
                "3dfff01b-0afb-4a07-967f-d1ccbd81102a"  
            ]  
        }  
    },  
    "priority": 500,  
    "handler": {  
        "@odata.type": "#microsoft.graph.onPhoneMethodLoadStartExternalUsersAuthHandler", 
        /* An Admin can state the country codes they would like to opt in or opt out from. */ 
        { 
                "includeAdditionalRegions": [222, 998], 
                 "excludeRegions": [] 
      } 
} 

HTTP/1.1 201 Created 
{ 
    "@odata.context": "https://microsoft.graph.microsoft.com/v1.0/$metadata#identity/authenticationEventListeners/$entity", 
    "@odata.type": "#microsoft.graph.onPhoneMethodLoadStartListener", 
    "id": "2be3336b-e3b4-44f3-9128-b6fd9ad39bb8", 
    "conditions": {  
        "applications": { 
            "includeApplications": [  
                "3dfff01b-0afb-4a07-967f-d1ccbd81102a"  
            ] 
        }   
    },   
    "handler": 
    {   
        "@odata.type": "#microsoft.graph.onPhoneMethodLoadStartExternalUsersAuthHandler ",  
        { 
            "includeAdditionalRegions": [222, 998], 
            "excludeRegions": [] 
        }, 
    } 
} 

How to deactivate telecom for regions

If you want to disable fraudulent requests coming from a region, you can deactivate the country codes using the excludeRegions property in the onPhoneMethodLoadStart policy.

For example, if an External ID application detects a high volume of nonverification SMS messages from a specific country code, you can deactivate telecom in that region. To do so, place the country code in the excludeRegions list.

Example REST APIs

POST https://graph.microsoft.com/v1.0/identity/authenticationEventListeners  
{  
    "@odata.type": "#microsoft.graph.onPhoneMethodLoadStartListener",  
    "conditions": {  
        "applications": {  
            "includeApplications": [  
                "3dfff01b-0afb-4a07-967f-d1ccbd81102a"  
            ]  
        }  
    },  
    "priority": 500,  
    "handler": {  
        "@odata.type": "#microsoft.graph.onPhoneMethodLoadStartExternalUsersAuthHandler", 
        /* An Admin can state the country codes they would like to opt in or opt out from. */ 
        { 
                "includeAdditionalRegions": [222, 998], 
                 "excludeRegions": [1001, 99, 777] 
      } 
} 

HTTP/1.1 201 Created 
{ 
    "@odata.context": "https://microsoft.graph.microsoft.com/v1.0/$metadata#identity/authenticationEventListeners/$entity", 
    "@odata.type": "#microsoft.graph.onPhoneMethodLoadStartListener", 
    "id": "2be3336b-e3b4-44f3-9128-b6fd9ad39bb8", 
    "conditions": {  
        "applications": { 
            "includeApplications": [  
                "3dfff01b-0afb-4a07-967f-d1ccbd81102a"  
            ] 
        }   
    },   
    "handler": 
    {   
        "@odata.type": "#microsoft.graph.onPhoneMethodLoadStartExternalUsersAuthHandler ",  
        { 
            "includeAdditionalRegions": [222, 998], 
            "excludeRegions": [] 
        }, 
    } 
}  

Next steps

• Understanding telephony fraud
• Add multifactor authentication (MFA) to an app
• Service limits and restrictions