On 10 November 2026, the Centre for Cybersecurity Belgium (CCB) warned that several Belgian organisations have been successfully attacked through Microsoft's SMS sign-in. According to Security.NL, which relayed the warning, a phone number and a code received by SMS were enough, with no password. The CCB asks organisations to switch this option off without delay. Any business that uses Microsoft 365 is directly concerned.
1. What the CCB found
According to Security.NL, the CCB says several Belgian organisations were successfully attacked. The attackers abused a Microsoft sign-in method in which SMS is the first factor: a phone number and a one-time code were enough. No password was required.
The CCB describes SMS and voice as weak authentication methods, whether they are used as a first or a second factor.
2. What the CCB recommends
The CCB advises acting now: disable SMS as a first factor, and remove SMS and voice from all administrator accounts. It also asks organisations to search their logs for successful SMS sign-ins, and to report any attack they find.
It warns against switching SMS off everywhere without preparation, because users could be locked out. First identify who depends on SMS, then test a phishing-resistant alternative such as passkeys or FIDO2.
3. Microsoft's timetable
According to Heise (22 September 2026), SMS sign-in is already disabled for Entra ID Free tenants. Microsoft plans to block it on 1 February 2027 in workforce tenants worldwide, then on 1 July 2027 for global administrators and external users.
In its message to administrators, Microsoft also says it is automatically disabling this option in tenants with no successful SMS sign-in over the past 30 days. The rollout is worldwide and is due to finish at the end of November 2026. SMS used as a second factor is not covered by this automatic change.
4. Why this matters for your marketing
A Microsoft account opens the door to email, shared files and brand assets. A compromised mailbox lets someone send fake messages to your customers and reset the passwords of other tools, such as your website or advertising accounts.
The CCB warning is about Microsoft. The same reflex applies to any tool that accepts an SMS code as the only way in.
The AI lens, humans first
AI can help review sign-in logs, spot unusual access and list the users who still sign in by SMS. It does that sorting in minutes. It does not decide who loses SMS, which alternative to roll out, or which administrator accounts come first: those choices stay human, because a mistake either locks colleagues out or leaves a door open. AI executes. Expertise decides, and keeps watch.
This week
Ask whoever administers Microsoft 365 whether SMS sign-in is enabled (in Entra, authentication methods, the "Use for sign-in" option). List the users who rely on it and give them an alternative before switching it off. Remove SMS and voice from administrator accounts, then check the sign-in logs.
Vistalaro Build secures access to your websites and automations (administrator accounts, stronger authentication, EU hosting) and documents who can reach what. With Vistalaro Pilot, a senior marketer draws up the inventory of your marketing access (email, website, advertising) with you and sets the order of fixes.
Who can still sign in to your tools with a simple SMS?
Check this week: the option can be switched off in a few clicks, provided you plan an alternative for each user.
Let's talk- Security.NL, Belgische overheid waarschuwt voor misbruik van inloggen via sms (10 November 2026, in Dutch)
- heise online, Microsoft removes SMS-based authentication from Entra ID (22 September 2026)
- Microsoft Message Center (miroir mc.merill.net), MC1465763 - Microsoft Entra: Prepare for Microsoft to disable unused or unsuccessful SMS first-factor sign-in (1 September 2026)