The announcement is mostly a timetable. On October 21, 2026, provider details are public but nothing can be configured yet. Configuration opens October 30, and Microsoft-provided SMS and voice delivery ends in two stages in 2027. If your tenant still sends MFA codes by text, you need a plan this quarter.
What CYOT actually is
Microsoft describes it as a way for organizations to continue using SMS or voice authentication with a supported telephony provider. You select a telephony provider through the Microsoft Security Store and manage the provider relationship for your organization.
The work is split in two:
- The provider delivers the SMS messages or voice calls that users need to complete authentication.
- Entra ID continues to enforce your authentication method policies and coordinates the authentication experience.
Identity consultant Jan Bakker explains how the pieces connect: you bring your own telephony provider, bought through the Microsoft Security Store, and Entra ID routes SMS and voice requests to it through a routing function that you run in your own Azure subscription.
Bakker's and Microsoft's descriptions make one point clear: SMS and voice remain authentication methods in Entra ID. Only Microsoft's delivery service is going away. A blog run by Soprano, one of the launch providers, says it plainly: Microsoft is retiring its own SMS and voice delivery, not the methods themselves.
Summary: Entra still decides who has to authenticate and how. Your contracted carrier delivers the code.
Launch providers and what they cost
Soprano and Telesign are the initial telephony providers available during the private preview. More providers will become available by general availability. Microsoft hasn't given a general availability date.
The commercial offers are listed as:
- Soprano: Per-user offer or per-transaction offer in Microsoft Security Store.
- Telesign: Telesign Verify for Microsoft Entra in Microsoft Security Store.
Microsoft doesn't publish a single rate. Its FAQ says the main cost is what your chosen provider charges for messages and calls, based on that provider's pricing and your usage. The Azure routing function adds standard consumption charges, which Microsoft expects to be small compared with the telephony bill. Microsoft also notes that moving users from SMS and voice to passkeys costs nothing extra.
Can you keep the SMS vendor you already have? Only if it's on the supported list. If it isn't, you'll need to pick a supported provider to keep SMS or voice after the retirement.
The dates that matter
| Date | What happens |
|---|---|
| September 1, 2026 | Passkeys become the default. Users enabled for SMS or voice are automatically enabled for passkeys and prompted to register when they complete MFA |
| September 18, 2026 | Provider information appears in Microsoft Security Store, according to Soprano's timeline |
| October 30, 2026 | The CYOT configuration experience opens |
| February 1, 2027 | Microsoft-provided SMS/voice retires for all users except Global Administrators and external users |
| July 1, 2027 | Microsoft-provided SMS/voice retires for Global Administrators and external users |
Soprano's write-up covers the same milestones, including that 30 October 2026: The configuration experience for Choose Your Own Telephony Provider becomes available in Microsoft Entra. Microsoft's retirement guide says customers who need to continue using SMS or voice can select and configure a telephony provider from Microsoft Security Store from that date.
Internal guests are easy to get wrong. They aren't in the July group. Internal guest users remain in scope for the February 1, 2027 retirement.
Microsoft's own Message Center post (MC1426371) adds a deadline the Learn pages don't spell out. Microsoft says, We recommend completing setup at least 4 weeks before the February 1 enforcement to allow sufficient time for testing and a cautious transition. That puts the practical target at early January 2027, and holiday change freezes make the window shorter still. The calendar left to procure a carrier contract, deploy an Azure function, run an evaluation and roll out in phases is tighter than it looks.
Summary: Configuration opens October 30, and Microsoft wants most tenants finished by about the first week of January.
What happens if you do nothing
Microsoft says users won't be locked out, but they will have to register a passkey. If a user still relies on Microsoft-provided SMS or voice after their retirement date and it's their only MFA method, Soprano's summary of Microsoft's guidance says they will receive a blocking prompt to register a passkey before continuing to sign in. Microsoft says there is no opt-out from that enforcement.
Microsoft offers a temporary opt-out from the automatic passkey enablement and registration campaign that runs from September 1, 2026 to February 1, 2027. You set the passkeyDynamicMigration property to true in the authentication methods policy through Microsoft Graph, which requires the Policy.ReadWrite.AuthenticationMethod permission. This only delays the prompts while you finish migrating. It doesn't stop the retirement.
Users you move to a configured provider before their deadline won't get the blocking prompt as part of the retirement enforcement. Anyone left on Microsoft-provided delivery will.
Three limits to check before you sign a contract
1. SMS as a primary sign-in method is still going away. The retirement of SMS as a first factor applies even when you use Choose Your Own Telephony Provider to continue using SMS or voice as a multifactor authentication method. Kiosk and frontline staff who sign in with a phone number and code need a different method. Microsoft suggests passkeys, QR code authentication or FIDO2 security keys.
2. Self-service password reset is affected too. The retirement of native SMS and voice applies across Microsoft Entra, including SSPR. However, users can still use SMS and voice through a telephony provider available in Microsoft Security Store. If you only audit MFA and miss SSPR, you'll get a wave of password-reset tickets in February.
3. The scope is narrow. CYOT currently covers Microsoft Entra ID only. Entra External ID and Azure AD B2C aren't included. Microsoft's retirement FAQ says B2C isn't affected, and External ID changes are due next year with a separate announcement. The retirement timeline also applies only to public cloud. Other cloud environments will follow on a later schedule.
You can configure one provider per channel: one for SMS and one for voice. That allows a split setup if one carrier covers your regions better for calls.
A step-by-step migration plan
Microsoft says detailed setup instructions will arrive when the feature launches on October 30, so these steps describe the workflow it has published so far, not exact admin center menus.
- Find who's affected. Microsoft provides a PowerShell script in its retirement guide to find users enabled for SMS or voice. You need Global Reader, Authentication Policy Administrator or Security Reader. Any non-zero result means your tenant is in scope.
- Move everyone you can to passkeys. Microsoft says to default to passkeys for every user segment that doesn't have a telephony requirement.
- Write down the exceptions. Microsoft asks you to identify the users who have a documented requirement for SMS or voice authentication and confirm that a phishing-resistant method doesn't meet the requirement.
- Compare providers. Look at geographic coverage, supported delivery channels, pricing, support, security, and compliance capabilities, and involve procurement, privacy and legal teams early.
- Set up the account and the Azure routing function. This function runs in your own subscription and sends authentication requests from Entra ID to your provider.
- Choose users or groups for SMS, voice or both.
- Run evaluation mode. Microsoft says it checks that requests reach the provider without changing anything for users. They keep getting codes the current way while you review the results.
- Roll out in stages. Microsoft's guidance says to stand up the carrier contract through the marketplace flow and test with a pilot group before broad rollout.
- Review your Global Administrator and external user accounts separately before July 1, 2027.
Success looks like this: your exception users get codes from the new carrier, evaluation results are clean, and nobody in that group sees a blocking passkey prompt after February 1.
Who to call when texts stop arriving
Microsoft supports the Entra platform, the provider configuration experience, authentication workflows and the routing to your provider. Your organization owns the provider relationship, its account configuration, its availability and any delivery problems. If texts aren't arriving, contact the carrier's support team. Microsoft says it will provide diagnostics to help tell platform problems from integration problems.
For help desks, that's a real change. "Users aren't getting their codes" used to be a Microsoft ticket. Now it's often a vendor ticket, with your own Azure function in between. Write a runbook before your first outage, not during it.
Security upgrade, or Microsoft handing over the phone bill?
Microsoft frames this as a security move. Its FAQ says organizations that still require SMS or voice will continue to have that option through telephony providers when there is a legitimate business, regulatory, or technical need. The security case holds up. SMS codes can be phished, intercepted and stolen through SIM swaps, and passkeys aren't vulnerable to those attacks.
Some practitioners are blunter. The conditionalaccess.tech blog titled its analysis with the line that Microsoft Just Stopped Paying the Phone Bill. Both readings are fair. Microsoft gets out of the carrier business, and customers who keep SMS take on the cost, the contract and the operational risk. That works as an incentive: once SMS shows up as a monthly invoice, budget holders tend to ask why they're still using it.
A caution on sources: Soprano's explainer is useful, but Soprano sells one of the two launch services. Treat vendor guides as a starting point and check claims against Microsoft's documentation.
My view as an analyst: CYOT is a backstop for regulated industries and the awkward edge cases. It shouldn't become your MFA strategy. With configuration opening October 30 and Microsoft asking for setup about four weeks before February 1, the order that makes sense is to move most users to passkeys now, start procurement for the documented exceptions immediately, and save a separate review for Global Administrators and external users before July.