What and why
Starting October 30, 2026, Microsoft Entra ID will make Choose Your Own Telephony Provider (CYOT) generally available. CYOT enables organizations to use a supported third-party telecommunications provider for SMS and voice authentication. Organizations select a supported provider through Microsoft Security Store and manage their commercial relationship directly with the provider.
Microsoft recommends phishing-resistant authentication methods, such as passkeys, instead of SMS or voice authentication. Organizations should use a telephony provider only for user populations that have a business, regulatory, or technical requirement for telephony-based authentication.
Rollout schedule
- General Availability (Worldwide): Beginning October 30, 2026
Impact on your organization
Who is affected
- Organizations with users who require SMS or voice authentication for business, regulatory, or technical reasons
Platforms and services
- Microsoft Entra ID
- Microsoft Security Store
What will happen
- Starting October 30, 2026, organizations can choose to configure a supported telephony provider for SMS and voice authentication.
- Your selected provider will deliver the SMS messages or voice calls users need to complete authentication.
- Microsoft Entra ID will continue to enforce authentication method policies and coordinate the authentication experience.
- Your organization will manage its commercial relationship with the selected provider.
- Microsoft-provided SMS and voice authentication is scheduled to be retired on February 1, 2027, for all users except Global Administrators and external users. The retirement date for Global Administrators and external users is July 1, 2027. Internal guest users remain subject to the February 1, 2027 retirement date.
- After the applicable retirement date, users whose only available MFA method is SMS or voice must register a passkey during sign-in unless the organization has configured a supported telephony provider. This registration prompt is blocking.
Action required and recommendations
If your organization plans to adopt CYOT:
- Identify affected users. Determine which users have a documented business, regulatory, or technical requirement for SMS or voice authentication.
- Evaluate phishing-resistant alternatives. Confirm that a phishing-resistant authentication method does not meet the requirements for those users.
- Review supported telephony providers. Compare providers based on geographic coverage, supported delivery channels, pricing, support, security, and compliance capabilities.
- Review organizational requirements. Work with the appropriate teams to review procurement, privacy, and regulatory requirements before selecting a provider.
- Plan your transition. Review Passkeys by default and retirement of Microsoft-provided SMS and voice authentication and plan your transition based on the retirement date applicable to each user population.
- Validate purchasing requirements. Review Purchase a SaaS solution and deploy a linked solution. Purchasing through Security Store requires an Azure billing subscription and resource group, plus the appropriate Azure subscription role.
- Estimate costs. Review provider pricing and expected Azure infrastructure charges before deployment.
Learn more
Compliance considerations
| Question | Answer |
| Does the change add any integration to third-party software products, and if so, what? | Yes. The change enables organizations to use a supported third-party telephony provider for SMS and voice authentication. Organizations select a provider through Microsoft Security Store, and the selected provider delivers the SMS messages or voice calls used for authentication. |