Microsoft Entra ID Introduces Telephony Providers Ahead of 2027 SMS Retirement

Microsoft is preparing to retire its native SMS and voice authentication services in Entra ID in 2027, while giving organizations the option to use third-party providers starting October 30, 2026.

The company has outlined the changes in Microsoft 365 Message Center advisory MC1519855, introducing a feature called Choose Your Own Telephony Provider (CYOT).

Microsoft has previously urged Entra ID users to move away from SMS authentication and is now encouraging organizations to adopt phishing-resistant alternatives, particularly passkeys.

Microsoft sets two deadlines for SMS and voice authentication

Microsoft will discontinue its native SMS and voice authentication services for most Entra ID users on February 1, 2027, while Global Administrators and external users will have until July 1, 2027, before the retirement takes effect for them.

Users who rely exclusively on SMS or voice authentication will need to register a passkey during sign-in unless their organization has configured a supported third-party telephony provider.

The changes affect Microsoft-provided SMS and voice verification rather than eliminating these authentication methods entirely.

Organizations can choose third-party authentication providers

Starting October 30, 2026, Microsoft’s CYOT feature will become generally available through the Microsoft Security Store.

The feature will allow administrators to choose supported third-party providers for SMS and voice authentication instead of relying on Microsoft’s native services.

Organizations will negotiate and manage commercial agreements directly with their selected providers.

Microsoft recommends that administrators identify affected users, evaluate phishing-resistant alternatives, and compare telephony providers based on geographic coverage, pricing, security, and compliance requirements.

Organizations planning to purchase services through the Microsoft Security Store will need an Azure billing subscription, a resource group, and appropriate Azure subscription permissions. They should also consider provider charges and potential Azure infrastructure costs.

Microsoft urges administrators to prepare for 2027 deadlines

Microsoft recommends reviewing existing authentication configurations and planning migrations before the February and July 2027 deadlines.

Organizations that fail to transition affected users to passkeys or configure a supported third-party provider risk disrupting employee and external user sign-ins.

The announcement follows Microsoft Entra’s October 2026 security update, which introduced additional security and AI-related protections.

Via Neowin