WA Folders
Home / Blog

Microsoft sent your verification code to WhatsApp? Why it happens and how to change it

Published

Early this morning someone on X asked a question that keeps coming up: Microsoft had started sending their sign-in codes through WhatsApp without asking, so how do you force them back to SMS? A thread on r/microsoft from last year makes the same complaint from a different angle. The poster was signing in to Outlook on a computer, the code went to WhatsApp on a phone in another room, and plain SMS used to work fine.

If a "Microsoft" chat has appeared in your WhatsApp with a six-digit code in it, here's what is going on and what you can do about it.

Why the code went to WhatsApp

Microsoft's documentation for work and school accounts (Microsoft Entra ID) says text message codes can be delivered over SMS, RCS or WhatsApp. If the phone number on your account has WhatsApp, Microsoft may send the code there instead of as a regular text.

The rollout started in India and Indonesia in late 2023. A Microsoft 365 admin notice from November 2024 said the channel would come back in India in December 2024 and expand to more countries, and university IT departments in Ireland and the UK were warning staff about it by late 2024 and early 2025.

According to Microsoft, a few rules decide which channel you get:

  • Only people who have WhatsApp on that number get codes there. Microsoft checks by quietly trying to deliver a message to the number you registered for text verification.
  • If your phone has no internet connection, or you uninstall WhatsApp, the code comes by SMS.
  • The first time a code arrives in WhatsApp, Microsoft is supposed to send an SMS telling you about the change. Oxford's IT security team says this notice doesn't always show up, so plenty of people never got the warning.

Microsoft's support page for personal Microsoft accounts (Outlook.com, Xbox, Skype and so on) says it will start phasing out SMS for sign-in and account recovery on those accounts. The pages cited here don't say whether personal accounts also get codes in WhatsApp, so the details below about the WhatsApp channel come from the work and school documentation.

Check that the message is really from Microsoft

A code arriving somewhere unexpected is exactly what a scam would look like, so check before you type it in.

  1. Open the chat and look at the name at the top. Microsoft says the real sender carries Microsoft branding and a verified checkmark. Trinity College Dublin told its users the sender might show as "Microsoft" or "Global OTP Service".
  2. Tap the name to see the number. Microsoft lists its WhatsApp sender as +1 (217) 302 1989.
  3. Only use the code if you started a sign-in or password reset yourself a moment ago. If a code turns up when you weren't signing in, don't enter it anywhere and don't share it with anyone who asks for it. Change your password if you're worried someone has it.

There's no setting to turn WhatsApp delivery off

Oxford's guidance is blunt about this. If your sign-in method is "Phone" with text messages, you can't switch off the WhatsApp channel on your own. Your options are to change the method Microsoft uses, or to change what's on your phone.

Option 1: Move your codes to an app (work or school account)

Microsoft recommends moving away from text and voice codes altogether. If you set up Microsoft Authenticator or a security key, Microsoft uses that ahead of text or WhatsApp, according to Oxford's guidance.

  1. Go to your Security info page and sign in with your work or school account.
  2. Select Add sign-in method and pick Microsoft Authenticator (or another option your organization allows), then follow the setup steps.
  3. Back on the Security info page, select Change next to "Default sign-in method", pick the app, and select Confirm.

Your organization decides which methods you're allowed to use. If you can't add an app, or you're told to keep phone verification, ask your IT help desk. They're also the people who can tell you whether your organization has turned WhatsApp delivery off, since Microsoft's admin notice says organizations can opt out of it.

Microsoft's own advice is to keep more than one sign-in method on the account, so you aren't locked out if you lose your phone. Add the app first, then decide whether to remove the phone number.

Option 2: Personal Microsoft account

Microsoft's steps for adding Authenticator to a personal account:

  1. Go to account.microsoft.com/security and sign in.
  2. Select Manage how I sign in.
  3. Select Add a new way to sign in or verify, choose Use an app, and scan the QR code with Microsoft Authenticator (choose Personal account in the app).

Microsoft warns that if two-step verification is on and you lose your contact method, recovering the account can take 30 days, and it recommends keeping three pieces of security info on the account.

Option 3: The workarounds people report

On Reddit, a few people say that blocking the Microsoft contact inside WhatsApp makes the codes fall back to SMS, and one commenter said it took a couple of sign-in attempts before that kicked in. Microsoft doesn't document this, so treat it as something to test while you still have another way in, not something to rely on.

The documented fallbacks are narrower. Microsoft says you get SMS when WhatsApp isn't installed on that number or the phone has no internet connection. Uninstalling WhatsApp to get your codes back is a big trade, so the app route above is usually the better fix.

If the real issue is that your phone isn't nearby when you sign in on a computer, one commenter in that r/microsoft thread suggested adding Authenticator to a second device, such as a tablet you keep at your desk.

Sources