Microsoft Entra ID
AuthenticationChoose your own telephony provider for SMS and voice authentication
In brief
The article now explains CYOT architecture, Azure Function integration, supported providers, and planning considerations such as coverage, pricing, fraud protection, resiliency, and costs.
What Entra admins need to know
Administrators can use the expanded guidance to evaluate providers and plan CYOT deployment.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Choose ayour own telephony provider for SMS and voice authentication
Microsoft Entra ID will support
Choose Your Own Telephony Provider, whichProvider (CYOT) lets organizations continue usingyour organization use a supported telecom provider to deliver SMS orand voice authentication with a supported telephony provider. You select a telephony providerfor Microsoft Entra ID.
With CYOT, Microsoft Entra continues to manage the authentication experience, including one-time passcode (OTP) generation and validation, while SMS messages and voice calls are delivered through the Microsoft Security Storetelecom provider that your organization selects and manage theconfigures.
CYOT gives your organization more control over telecom provider relationship for your organization.selection, geographic coverage, pricing, and telecom delivery.
Microsoft recommends phishing-resistant authentication methods, such as
How CYOT works
When SMS or voice authentication is required:
- Microsoft Entra initiates the authentication request.
- Microsoft Entra sends the request to the CYOT integration deployed in your Azure subscription.
- The integration sends the request to your configured telecom provider.
- Your telecom provider delivers the SMS message or voice call to the user.
- Microsoft Entra completes the authentication flow.
The Azure Function deployed in your subscription connects Microsoft Entra with your telecom provider.
:::image type="content" source="media/concept-phone-providers/telephony-provider-integration-diagram.jpeg" alt-text="Simplified CYOT architecture diagram showing Microsoft Entra connected to a telecom provider through an Azure Function in your Azure subscription." lightbox="media/concept-phone-providers/telephony-provider-integration-diagram.jpeg":::
Available telephony providers
Select a supported telecom provider based on your organization's coverage, pricing, and other requirements.
Review pricing and other commercial details for the available provider offers:
- Soprano: Per-user offer or per-transaction offer in
Microsoft Security Store.Microsoft Security Store. - Telesign: Telesign Verify for Microsoft Entra in
Microsoft Security Store.Microsoft Security Store. - Infobip.
How Choose Your Own Telephony Provider worksUnderstand your responsibilities
Your selected telephonyWith CYOT, your organization owns the Azure resources deployed in your subscription and your telecom provider deliversaccount, so you keep full control over how they run. The guided deployment sets up the integration for you, and your team manages the Azure Function and provider account from there.
| Owner | Responsibilities |
|---|---|
| Microsoft | Microsoft Entra authentication and the handoff to your endpoint. |
| Customer | Deploying and operating the integration, managing the telecom provider account, and configuring fraud controls. |
| Telephony provider | SMS |
Get started with CYOT
At a high level, setting up CYOT involves:
- Subscribe to a telecom provider. Review the available provider offers in Microsoft Security Store and purchase the offer that meets your organization's requirements.
- Set up the provider integration. Deploy the integration in your Azure subscription and connect it to your provider.
- Create an SMS or voice
calls that users need to complete authentication.profile. Route SMS or voice authentication through your provider. - Evaluate. Validate the integration while Microsoft
Entra IDcontinues toenforcedeliver messages, so users aren't affected. - Roll out. Move traffic to your
authentication method policies and coordinates the authentication experience.provider gradually, validating at each stage.
For detailed instructions, see Set up SMS and voice with your own telecom provider by using APIs.
Your organization is responsible for selecting a telephony provider, reviewing its regional coverage and terms, completing the provider agreement, configuring the provider for Microsoft Entra ID, and monitoring the service.
For the full transition schedule, see Passkeys by default and retirement of Microsoft-provided SMS and voice authentication.
Plan your Choose Your Own Telephony Provider deployment
Before you select a provider:moving production authentication traffic to CYOT, consider fraud protection, resiliency, and costs based on your organization's requirements.
Prevent telephony fraud
Work with your telecom provider to configure the fraud protection, destination, usage, and spending controls appropriate for your organization's traffic and risk requirements.
See Prevent telephony fraud when using your own telecom provider.
Plan for resiliency
Plan the availability and recovery of the Azure resources and telecom provider used by your CYOT integration.
Organizations with additional availability requirements can implement cross-region resiliency and, where appropriate, configure provider redundancy.
See Plan for resiliency when using your own telecom provider.
Understand costs
CYOT can involve two separate categories of costs:
IdentifyTelecom provider costs for SMS and voice delivery through your selected provider.- Azure costs for the
users who have a documented requirement forAzure Function and supporting resources deployed in your subscription.
Review both before moving production authentication traffic to CYOT.
See Estimate telecom-provider and Azure hosting costs.
Troubleshoot CYOT
To diagnose SMS or voice authentication.
See Troubleshoot SMS and voice with your own telecom provider for diagnostic guidance and regulatory requirements with the appropriate teams in your organization.
Next stepsRelated content
Review frequently asked questions about telephony providersSet up SMS and voice with your own telecom provider by using APIs.- Prevent telephony fraud when using your own telecom provider.
- Plan for resiliency when using your own telecom provider.
- Troubleshoot SMS and voice with your own telecom provider.
- Estimate telecom-provider and Azure hosting costs.
- Passkeys by default and retirement of Microsoft-provided SMS and voice authentication.
Plan a passkey deployment.Review voice call authenticationSMS-based authentication for Microsoft Entra ID.
@@ -1,51 +1,122 @@ ----title: Choose a telephony provider for SMS and voice authentication-description: Learn about Choose Your Own Telephony Provider for SMS and voice authentication in Microsoft Entra ID.+title: Choose your own telephony provider for SMS and voice authentication+description: Learn how CYOT works, available telecom providers, and how to plan setup, fraud protection, resiliency, and costs. ms.topic: concept-article-ms.date: 09/23/2026-ai-usage: ai-generated+ms.date: 10/30/2026+ai-usage: ai-assisted # Customer intent: As an identity administrator, I want to understand Choose Your Own Telephony Provider so that I can plan continued use of SMS or voice authentication. --- -# Choose a telephony provider for SMS and voice authentication+# Choose your own telephony provider for SMS and voice authentication -Microsoft Entra ID will support Choose Your Own Telephony Provider, which lets organizations continue using SMS or voice authentication with a supported telephony provider. You select a telephony provider through the Microsoft Security Store and manage the provider relationship for your organization.+<a id="choose-a-telephony-provider-for-sms-and-voice-authentication"></a> -Microsoft recommends phishing-resistant authentication methods, such as [passkeys](concept-authentication-passkeys-fido2.md), instead of SMS or voice. Use a telephony provider only for user populations that have a business, regulatory, or technical requirement for telephony-based authentication.+Choose Your Own Telephony Provider (CYOT) lets your organization use a supported telecom provider to deliver SMS and voice authentication for Microsoft Entra ID.++With CYOT, Microsoft Entra continues to manage the authentication experience, including one-time passcode (OTP) generation and validation, while SMS messages and voice calls are delivered through the telecom provider that your organization selects and configures.++CYOT gives your organization more control over telecom provider selection, geographic coverage, pricing, and telecom delivery. > [!IMPORTANT]-> Choose Your Own Telephony Provider isn't available to configure yet. Information about the providers participating in the private preview is available now. The configuration experience becomes available beginning October 30, 2026.+> Microsoft recommends phishing-resistant authentication methods, such as [passkeys](concept-authentication-passkeys-fido2.md), instead of SMS or voice. Use a telephony provider only for user populations that have a business, regulatory, or technical requirement for telephony-based authentication.++<a id="how-choose-your-own-telephony-provider-works"></a>++## How CYOT works++When SMS or voice authentication is required:++1. Microsoft Entra initiates the authentication request.+1. Microsoft Entra sends the request to the CYOT integration deployed in your Azure subscription.+1. The integration sends the request to your configured telecom provider.+1. Your telecom provider delivers the SMS message or voice call to the user.+1. Microsoft Entra completes the authentication flow.++The Azure Function deployed in your subscription connects Microsoft Entra with your telecom provider.++:::image type="content" source="media/concept-phone-providers/telephony-provider-integration-diagram.jpeg" alt-text="Simplified CYOT architecture diagram showing Microsoft Entra connected to a telecom provider through an Azure Function in your Azure subscription." lightbox="media/concept-phone-providers/telephony-provider-integration-diagram.jpeg"::: ## Available telephony providers -Soprano and Telesign are the initial telephony providers available during the private preview. More providers will become available by general availability.+Select a supported telecom provider based on your organization's coverage, pricing, and other requirements. Review pricing and other commercial details for the available provider offers: -- Soprano: [Per-user offer](https://securitystore.microsoft.com/solutions/sopranodesignlimited1620113206416.soprano_entraid_per_user) or [per-transaction offer](https://securitystore.microsoft.com/solutions/sopranodesignlimited1620113206416.soprano_entraid_per_transaction) in Microsoft Security Store.-- Telesign: [Telesign Verify for Microsoft Entra](https://securitystore.microsoft.com/solutions/telesigncorporation1779799505747.telesign-verify-cyot-azure) in Microsoft Security Store.+- Soprano: [Per-user offer](https://securitystore.microsoft.com/solutions/sopranodesignlimited1620113206416.soprano_entraid_per_user) or [per-transaction offer](https://securitystore.microsoft.com/solutions/sopranodesignlimited1620113206416.soprano_entraid_per_transaction) in [Microsoft Security Store](https://securitystore.microsoft.com/).+- Telesign: [Telesign Verify for Microsoft Entra](https://securitystore.microsoft.com/solutions/telesigncorporation1779799505747.telesign-verify-cyot-azure) in [Microsoft Security Store](https://securitystore.microsoft.com/).+- Infobip.++> [!NOTE]+> Provider availability, coverage, pricing, and commercial terms can vary. Review the provider's [Microsoft Security Store](https://securitystore.microsoft.com/) listing for the latest information before purchasing.++## Understand your responsibilities++With CYOT, your organization owns the Azure resources deployed in your subscription and your telecom provider account, so you keep full control over how they run. The guided deployment sets up the integration for you, and your team manages the Azure Function and provider account from there.++| Owner | Responsibilities |+|---|---|+| Microsoft | Microsoft Entra authentication and the handoff to your endpoint. |+| Customer | Deploying and operating the integration, managing the telecom provider account, and configuring fraud controls. |+| Telephony provider | SMS and voice delivery, and offering fraud controls. |++## Get started with CYOT++At a high level, setting up CYOT involves:++1. **Subscribe to a telecom provider.** Review the available provider offers in [Microsoft Security Store](https://securitystore.microsoft.com/) and purchase the offer that meets your organization's requirements.+1. **Set up the provider integration.** Deploy the integration in your Azure subscription and connect it to your provider.+1. **Create an SMS or voice profile.** Route SMS or voice authentication through your provider.+1. **Evaluate.** Validate the integration while Microsoft continues to deliver messages, so users aren't affected.+1. **Roll out.** Move traffic to your provider gradually, validating at each stage.++For detailed instructions, see [Set up SMS and voice with your own telecom provider by using APIs](how-to-set-up-sms-voice-api.md).++<a id="plan-your-choose-your-own-telephony-provider-deployment"></a>++## Plan your deployment++Before moving production authentication traffic to CYOT, consider fraud protection, resiliency, and costs based on your organization's requirements.++### Prevent telephony fraud++Work with your telecom provider to configure the fraud protection, destination, usage, and spending controls appropriate for your organization's traffic and risk requirements.++See [Prevent telephony fraud when using your own telecom provider](choose-your-own-telephony-fraud-costs.md).++### Plan for resiliency++Plan the availability and recovery of the Azure resources and telecom provider used by your CYOT integration.++Organizations with additional availability requirements can implement cross-region resiliency and, where appropriate, configure provider redundancy.++See [Plan for resiliency when using your own telecom provider](choose-your-own-telephony-reliability.md).++### Understand costs++CYOT can involve two separate categories of costs: -## How Choose Your Own Telephony Provider works+- Telecom provider costs for SMS and voice delivery through your selected provider.+- Azure costs for the Azure Function and supporting resources deployed in your subscription. -Your selected telephony provider delivers the SMS messages or voice calls that users need to complete authentication. Microsoft Entra ID continues to enforce your authentication method policies and coordinates the authentication experience.+Review both before moving production authentication traffic to CYOT. -Your organization is responsible for selecting a telephony provider, reviewing its regional coverage and terms, completing the provider agreement, configuring the provider for Microsoft Entra ID, and monitoring the service.+See [Estimate telecom-provider and Azure hosting costs](phone-providers-faq.yml#how-much-does-choose-your-own-telephony-provider-cost). -For the full transition schedule, see [Passkeys by default and retirement of Microsoft-provided SMS and voice authentication](concept-sms-voice-retirement.md).+## Troubleshoot CYOT -## Plan your Choose Your Own Telephony Provider deployment+To diagnose SMS or voice issues, identify whether the issue is in Microsoft Entra authentication and configuration, your CYOT integration, or telecom provider delivery. -Before you select a provider:+See [Troubleshoot SMS and voice with your own telecom provider](troubleshoot-voice-call-sms.md#monitor-and-troubleshoot-your-own-telephony-provider) for diagnostic guidance and information about where to get support. -- Identify the users who have a documented requirement for SMS or voice authentication.-- Confirm that a phishing-resistant method doesn't meet the requirement.-- Compare supported telephony providers based on geographic coverage, supported delivery channels, pricing, support, security, and compliance capabilities.-- Review procurement, privacy, and regulatory requirements with the appropriate teams in your organization.+<a id="next-steps"></a> -## Next steps+## Related content -- [Review frequently asked questions about telephony providers](phone-providers-faq.yml).-- [Prepare for the retirement of Microsoft-provided SMS and voice authentication](concept-sms-voice-retirement.md).-- [Plan a passkey deployment](how-to-deploy-phishing-resistant-passwordless-authentication.md).-- [Review voice call authentication](concept-authentication-phone-options.md).+- [Set up SMS and voice with your own telecom provider by using APIs](how-to-set-up-sms-voice-api.md).+- [Prevent telephony fraud when using your own telecom provider](choose-your-own-telephony-fraud-costs.md).+- [Plan for resiliency when using your own telecom provider](choose-your-own-telephony-reliability.md).+- [Troubleshoot SMS and voice with your own telecom provider](troubleshoot-voice-call-sms.md#monitor-and-troubleshoot-your-own-telephony-provider).+- [Estimate telecom-provider and Azure hosting costs](phone-providers-faq.yml#how-much-does-choose-your-own-telephony-provider-cost).+- [Passkeys by default and retirement of Microsoft-provided SMS and voice authentication](concept-sms-voice-retirement.md).+- [SMS-based authentication for Microsoft Entra ID](howto-authentication-sms-signin.md).