Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Microsoft Entra’s Choose Your Own Telephony Provider (CYOT) is now generally available, while Microsoft-provided SMS and voice authentication—including SMS first-factor sign-in—will retire on February 1, 2027. New deployment guidance covers provider integration, testing, rollout, fraud controls, resiliency, and diagnostics. The period also adds preview access-package reviews in Identity Governance and documented passkey credential management for External ID.
Entra ID · AuthenticationMicrosoft Entra now generally supports Choose Your Own Telephony Provider for SMS and voice authentication. Organizations must select a provider, set up CYOT, and transition from Microsoft-provided services by February 1, 2027; Microsoft recommends phishing-resistant methods such as passkeys.
Entra ID · AuthenticationThe SMS-based sign-in guidance now labels the setting “Enable first factor sign-in” and states that it is automatically disabled after 30 days without traffic. The same guidance places Microsoft-provided SMS and voice authentication retirement on February 1, 2027.
Entra ID · AuthenticationThe new setup guide covers connecting Microsoft Entra SMS and voice authentication to a telecom provider through CYOT, including purchasing, Azure deployment, required permissions, policy configuration, testing, and rollout.
ID Governance · GovernanceIn preview, reviewers can approve or deny access packages as single items in catalog access reviews. A denial removes the package assignment and all resources it grants at the review end date; the documented prerequisites include an eligible subscription, the Identity Governance Administrator role, and a catalog containing the packages.
External ID · AuthenticationA new API reference explains how signed-in customers can list, register, and delete their own passkeys, with setup, permissions, authentication, and endpoint details. Applications must manually provision the service principal and grant the required delegated permission; app-only tokens are not supported.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation states that Microsoft-provided SMS and voice authentication, including SMS first-factor sign-in, retires on February 1, 2027. It also updates the setting label to “Enable first factor sign-in” and notes automatic disabling after 30 days without traffic.
The article now explains CYOT architecture, Azure Function integration, supported providers, and planning considerations such as coverage, pricing, fraud protection, resiliency, and costs.
The new guide explains how to connect Microsoft Entra SMS and voice authentication to a telecom provider using CYOT, including purchasing, Azure deployment, permissions, policy configuration, testing, and rollout.
The documentation explains CYOT delivery dependencies and resiliency approaches, including multi-region Azure Front Door deployments, secondary telecom providers, failover testing, capacity planning, and associated costs.
The documentation explains how to trace Choose Your Own Telephony Provider requests across Microsoft Entra audit logs, sign-in logs, Function App logs, and the telecom provider portal, including relevant fields and queries.
The article now explains how to trace Choose Your Own Telephony Provider requests through Microsoft Entra audit and sign-in logs, Function App logs, and the telecom provider portal.
A new article explains how to configure telecom-provider fraud, destination, channel, spending, and alert controls; secure the CYOT integration; monitor activity; and respond to suspected fraud.
Microsoft Entra ID now generally supports Choose Your Own Telephony Provider (CYOT) for SMS and voice authentication, retiring Microsoft-provided services by February 1, 2027. Organizations must select a provider, set up CYOT, and transition before that date, while Microsoft recommends phishing-resistant methods like passkeys.
The article now covers general Microsoft Entra MFA SMS and voice problems, including telecom delivery, Microsoft’s visibility, and investigation using correlation IDs and timestamps. CYOT-specific troubleshooting content was replaced, and phishing-resistant alternatives are recommended.
The article now uses a shorter title and consolidated guidance emphasizing that CYOT updates the existing SMS or voice policy, may affect current users, and requires preserving production `includeTargets`. It also recommends saving the current policy JSON and using a test tenant for alternate targeting.
The SMS/voice API setup documentation now links its rollout and diagnostic references to the choose-your-own-telephony troubleshooting page.
The monitoring and troubleshooting references now point to the dedicated choose-your-own-telephony troubleshooting page.
The phone providers documentation now links SMS and voice troubleshooting guidance to the dedicated `choose-your-own-telephony-troubleshoot.md` page.
The documentation link for monitoring and troubleshooting SMS and voice with your own telecom provider now points to the custom-telephony troubleshooting page.
The Agent ID default inactivity policy page updates links to related lifecycle policy and end-user agent management documentation.
Microsoft Entra ID Governance now supports reviewing access packages as single items in catalog access reviews. Reviewers can approve or deny each package; denial removes the assignment and all resources granted through it at the review end date.
The documentation now states that catalog access reviews support access packages in preview and links to additional guidance.
The documentation no longer includes the note that nested group drift is excluded and that reports compare assignments with users directly assigned to a group.
The documentation now covers using the Microsoft Entra External ID credential management API to let signed-in customers list, register, and delete passkeys, including setup, permissions, authentication, and endpoint details.
The documentation now points to the credential management API for signed-in customers to list, register, and delete their own passkeys with delegated permissions. It also adds a sample and warns that its deletion flow is for test tenants only.
The custom policies guidance now includes a screenshot of the Migration Policy Analyzer UI and updated author metadata.
The JavaScript, React, and single-page application entries now link to “List and register passkeys” GitHub samples instead of the previous passkey samples.
The documentation now lists Universal CAE’s supported device-based signals without the “preview” label.
The configuration guide no longer includes the note that a special Entra Admin Center link might be needed during the September 2026 rollout to view custom header details in Global Secure Access traffic logs.
