51789 text message: is it really Microsoft?

Use 51789 only for the code box already waiting in a Microsoft sign-in.

The normal pattern is password first, then a separate MFA prompt, then a short SMS code from 51789. If you did not already have a Microsoft, Microsoft 365, Azure, work, or school sign-in open, do not go hunting for a place to type it.

Expect one short code, not a chat.

Genuine 51789 traffic is built to carry the authentication secret and little else. It should not negotiate with you, ask what device you use, ask who you are, or send a second instruction about a technician calling next.

Use it for work or school MFA when your tenant asks by SMS.

Many 51789 messages come from Microsoft Entra multifactor authentication, the system employers and schools use behind Microsoft 365 and Azure sign-ins. The text is tied to that login flow, not to a retail order or a Microsoft Store purchase.

Do not enter a surprise 51789 code anywhere.

A real Microsoft system can send a real code because someone else tried your username and password. The text can be genuine and still mean trouble, so the safe move is to stop the login you did not start.

Keep the code off calls, tickets, and chat.

A real Microsoft MFA code belongs in the prompt that requested it, not in Teams chat, a help-desk ticket, a phone call, or a form opened from a message. Anyone asking you to read it back is trying to become you for one sign-in.

Do not open links in a message claiming to be 51789.

A real Entra MFA SMS does not need a link because the sign-in prompt is already open in your browser or app. Fake texts add a button or URL so they can collect your password and the fresh code on the same page.

Do not reply with the code.

Microsoft’s SMS code is for the sign-in screen, not the SMS thread. A fake may say “reply with the 6-digit code to cancel,” because replying hands the attacker the exact second factor they triggered.

Hang up on anyone who says they need your 51789 code.

The common move is a call minutes after the SMS: “Microsoft security,” “company IT,” or “payroll” says they are stopping fraud. They are not stopping it. They are using your code to finish it.

Stop at texts that sell a Microsoft refund or Defender renewal.

51789 is not a billing desk. A message about a $399 Defender charge, a Microsoft 365 refund, or a cancelled subscription is using the Microsoft name for a payment scam, not sending Entra MFA.

Do not trust a normal phone number dressed up as Microsoft MFA.

A 10-digit sender, email-to-text address, messaging app, or group thread is not the same channel as the U.S. short code 51789. Copying the words “Microsoft authentication code” does not make the sender Microsoft’s short code.

Ignore messages that ask for your Microsoft password.

51789 traffic can prove possession of a second factor, but it has no reason to ask for the first factor. If the same text or linked page wants your password, PIN, recovery code, or full email session, it is credential theft.

Do not approve repeated codes you did not request.

A burst of 51789 messages can mean an attacker is testing a known password, retrying MFA, or trying to wear you down before calling. The code may be real, but the sign-in is not yours.

Finish the sign-in only if you started it.

If you were logging in to Microsoft 365, Azure, Outlook, or a work portal and the prompt asked for an SMS code, enter the code there. If the text came first, stop.

Enter the code only in the prompt you opened yourself.

Do not paste it into a page reached from the text, and do not read it to a caller. The code is a one-time key for that login attempt.

Do not use the code if the text arrived out of nowhere.

Change the Microsoft account password from a page or app you reach yourself, then review sign-in activity and security info. For a work or school account, assume your organization may need to check the session trail.

Check Microsoft Support before responding to any follow-up.

Use Microsoft’s published “Why is Microsoft texting me?” guidance at https://support.microsoft.com/en-us/accounts-billing/security/why-is-microsoft-texting-me. Use that route instead of a link, number, or callback instruction inside the text.

Use the Entra MFA FAQ for work or school accounts.

Microsoft publishes the Entra multifactor authentication FAQ at https://learn.microsoft.com/en-us/entra/identity/authentication/multi-factor-authentication-faq. It covers SMS MFA behavior and lists the short codes Microsoft uses by country.

Tell your help desk if the account belongs to work or school.

Send the time of the 51789 text, the sender shown on your phone, and whether you entered the code. Your admin can check Microsoft Entra sign-in logs and remove attacker-added authentication methods if needed.