Friday, 30 October 2026

Starting March 2026, Microsoft Entra ID will GA passkey profiles and synced passkeys for tenants with Passkeys (FIDO2) enabled. Existing tenants will be auto-migrated to a default passkey profile with configurable passkeyType. Registration campaign settings and rollout timelines vary by cloud region.

The documentation states that Microsoft-provided SMS and voice authentication, including SMS first-factor sign-in, retires on February 1, 2027. It also updates the setting label to “Enable first factor sign-in” and notes automatic disabling after 30 days without traffic.

The article now explains CYOT architecture, Azure Function integration, supported providers, and planning considerations such as coverage, pricing, fraud protection, resiliency, and costs.

The new guide explains how to connect Microsoft Entra SMS and voice authentication to a telecom provider using CYOT, including purchasing, Azure deployment, permissions, policy configuration, testing, and rollout.

The documentation explains CYOT delivery dependencies and resiliency approaches, including multi-region Azure Front Door deployments, secondary telecom providers, failover testing, capacity planning, and associated costs.

The documentation explains how to trace Choose Your Own Telephony Provider requests across Microsoft Entra audit logs, sign-in logs, Function App logs, and the telecom provider portal, including relevant fields and queries.

The article now explains how to trace Choose Your Own Telephony Provider requests through Microsoft Entra audit and sign-in logs, Function App logs, and the telecom provider portal.

A new article explains how to configure telecom-provider fraud, destination, channel, spending, and alert controls; secure the CYOT integration; monitor activity; and respond to suspected fraud.

Microsoft Entra ID now generally supports Choose Your Own Telephony Provider (CYOT) for SMS and voice authentication, retiring Microsoft-provided services by February 1, 2027. Organizations must select a provider, set up CYOT, and transition before that date, while Microsoft recommends phishing-resistant methods like passkeys.

The article now covers general Microsoft Entra MFA SMS and voice problems, including telecom delivery, Microsoft’s visibility, and investigation using correlation IDs and timestamps. CYOT-specific troubleshooting content was replaced, and phishing-resistant alternatives are recommended.

The article now uses a shorter title and consolidated guidance emphasizing that CYOT updates the existing SMS or voice policy, may affect current users, and requires preserving production `includeTargets`. It also recommends saving the current policy JSON and using a test tenant for alternate targeting.

The SMS/voice API setup documentation now links its rollout and diagnostic references to the choose-your-own-telephony troubleshooting page.

The monitoring and troubleshooting references now point to the dedicated choose-your-own-telephony troubleshooting page.

The phone providers documentation now links SMS and voice troubleshooting guidance to the dedicated `choose-your-own-telephony-troubleshoot.md` page.

The documentation link for monitoring and troubleshooting SMS and voice with your own telecom provider now points to the custom-telephony troubleshooting page.

Microsoft Entra passkeys on Windows will be generally available from late April 2026, enabling passwordless, phishing-resistant sign-in on Windows devices without requiring explicit admin allow-listing. It supports corporate, personal, and shared devices, with control via Authentication Methods policies and Conditional Access. No action is needed unless blocking is desired.

The Agent ID default inactivity policy page updates links to related lifecycle policy and end-user agent management documentation.

Microsoft Entra ID Governance now supports reviewing access packages as single items in catalog access reviews. Reviewers can approve or deny each package; denial removes the assignment and all resources granted through it at the review end date.

The documentation now states that catalog access reviews support access packages in preview and links to additional guidance.

The documentation no longer includes the note that nested group drift is excluded and that reports compare assignments with users directly assigned to a group.

The documentation now covers using the Microsoft Entra External ID credential management API to let signed-in customers list, register, and delete passkeys, including setup, permissions, authentication, and endpoint details.

The documentation now points to the credential management API for signed-in customers to list, register, and delete their own passkeys with delegated permissions. It also adds a sample and warns that its deletion flow is for test tenants only.

The custom policies guidance now includes a screenshot of the Migration Policy Analyzer UI and updated author metadata.

The JavaScript, React, and single-page application entries now link to “List and register passkeys” GitHub samples instead of the previous passkey samples.

The documentation now lists Universal CAE’s supported device-based signals without the “preview” label.

The configuration guide no longer includes the note that a special Entra Admin Center link might be needed during the September 2026 rollout to view custom header details in Global Secure Access traffic logs.