Microsoft Entra: Choose your own telephony provider for SMS and voice authentication

What and why

Starting October 30, 2026, Microsoft Entra ID will make Choose Your Own Telephony Provider (CYOT) generally available. CYOT enables organizations to use a supported third-party telecommunications provider for SMS and voice authentication. Organizations select a supported provider through Microsoft Security Store and manage their commercial relationship directly with the provider.

Microsoft recommends phishing-resistant authentication methods, such as passkeys, instead of SMS or voice authentication. Organizations should use a telephony provider only for user populations that have a business, regulatory, or technical requirement for telephony-based authentication.

Rollout schedule

• General Availability (Worldwide): Beginning October 30, 2026

Impact on your organization

Who is affected

• Organizations with users who require SMS or voice authentication for business, regulatory, or technical reasons

Platforms and services

• Microsoft Entra ID
• Microsoft Security Store

What will happen

• Starting October 30, 2026, organizations can choose to configure a supported telephony provider for SMS and voice authentication.
• Your selected provider will deliver the SMS messages or voice calls users need to complete authentication.
• Microsoft Entra ID will continue to enforce authentication method policies and coordinate the authentication experience.
• Your organization will manage its commercial relationship with the selected provider.
• Microsoft-provided SMS and voice authentication is scheduled to be retired on February 1, 2027, for all users except Global Administrators and external users. The retirement date for Global Administrators and external users is July 1, 2027. Internal guest users remain subject to the February 1, 2027 retirement date.
• After the applicable retirement date, users whose only available MFA method is SMS or voice must register a passkey during sign-in unless the organization has configured a supported telephony provider. This registration prompt is blocking.

Action required and recommendations

If your organization plans to adopt CYOT:

• Identify affected users. Determine which users have a documented business, regulatory, or technical requirement for SMS or voice authentication.
• Evaluate phishing-resistant alternatives. Confirm that a phishing-resistant authentication method does not meet the requirements for those users.
• Review supported telephony providers. Compare providers based on geographic coverage, supported delivery channels, pricing, support, security, and compliance capabilities.
• Review organizational requirements. Work with the appropriate teams to review procurement, privacy, and regulatory requirements before selecting a provider.
• Plan your transition. Review Passkeys by default and retirement of Microsoft-provided SMS and voice authentication and plan your transition based on the retirement date applicable to each user population.
• Validate purchasing requirements. Review Purchase a SaaS solution and deploy a linked solution. Purchasing through Security Store requires an Azure billing subscription and resource group, plus the appropriate Azure subscription role.
• Estimate costs. Review provider pricing and expected Azure infrastructure charges before deployment.

Learn more

• Choose a telephony provider for SMS and voice authentication - Microsoft Entra ID | Microsoft Learn
• Estimate telephony provider and Azure hosting costs: ExternalPhoneProvider-AzureFunction-Sample/docs/COST-CALCULATOR.md at main · Azure-Samples/ExternalPhoneProvider-AzureFunction-Sample
• Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - Microsoft Entra ID | Microsoft Learn
• Purchase and deploy a SaaS solution from Security Store - Microsoft Security Store | Microsoft Learn

Compliance considerations