Does a Microsoft account accept a VoIP number for verification codes?

What Microsoft says about VoIP

Microsoft's page on verification code problems answers it directly: “VOIP numbers cannot be added as a way to sign in or get verification codes. Please add a mobile phone number.” (Microsoft)

That's a rule, not a recommendation. If your security info is a Google Voice number or another internet number, rule that out first. How services tell a mobile line from an internet number explains the check behind it.

The part most people miss: SMS is on its way out

The same page carries a note: “we will start phasing out SMS as a method of authentication and account recovery for personal Microsoft accounts.” Microsoft's reason is blunt: “SMS authentication is vulnerable to phishing and SIM-swap attacks.” (Microsoft)

In practice you may not be offered a phone option at all. Microsoft's security info page: “The option to add a new phone number may not be available for your Microsoft account. You may only see options such as a recovery email address, Microsoft Authenticator, or a passkey when adding new sign-in or verification methods.” (Microsoft)

So if you're about to get a mobile number just for a personal Microsoft account, open that screen first. There may be nowhere to put it.

What to set up instead

• A passkey. Microsoft describes passkeys as “a modern, phishing-resistant way to sign in using your device’s built-in authentication (like Face ID, fingerprint, or PIN).” (Microsoft)
• Microsoft Authenticator, which Microsoft says “also allows you to sign in even if the verification device is offline.” (Microsoft)
• A verified recovery email. Asked whether you can still recover the account after losing your phone, Microsoft answers: “Yes. With a verified email and passkey, you’ll have secure and reliable recovery options.”
• More than one of these. With two-step verification on, Microsoft says “we strongly recommend you have three pieces of security info associated with your account, just in case.” (Microsoft)

If you're already locked out

Four things from Microsoft's troubleshooting page decide how painful this gets. Read them before you start changing things.

1. 01Don't swap everything at once. “Make sure you don't change all your security info at the same time, otherwise your account may be restricted for 30 days.”
2. 02Replacing all of it means waiting. If you know your password but can't reach any of your security info, you can replace it, and then: “Once it has been replaced, you must wait 30 days before being able to sign in.” If the old method turns up during those 30 days, using it cancels the change.
3. 03Stop pressing resend. “Don't make excessive or repetitive requests to alternative emails or phone numbers as this can cause us to block you and not send verification codes.” Microsoft suggests waiting a day, and up to a week if nothing changes.
4. 04Support won't send you a code. “To protect your account and its contents, our support agents are not allowed to send verification codes or access and change account details.” When nothing else works, the route is the account recovery form.

When a real mobile line is still the answer

Less often than it used to be. It makes sense if your account still offers a phone option, the number on it is an internet number or one you've lost, and you want a text fallback next to a passkey and a recovery email. It also makes sense for the many services that still lean on text codes.

A Cleat line is a real US mobile number, not VoIP. It receives texts, and incoming calls arrive transcribed, in an inbox you can share. It can't send texts or place calls. It's $24.99 a month. If the account belongs to a small business and its codes shouldn't live on one employee's phone, see a shared number for teams. No provider can promise that every service accepts every number, and Microsoft may simply not offer your account a phone option.

If you're abroad

Microsoft lists location as a cause itself: “If you're in a region where Microsoft's SMS services have limited functionality or are temporarily unavailable, this could prevent the code from being delivered.” A passkey or Authenticator doesn't need a text to reach you, which makes either one the setup that survives travel. Living outside the US for good? Cleat for expats covers what a US number is and isn't useful for.