Choose Your Own Telephony Fraud Costs
Authentication
The documentation now links to instructions for setting up SMS and voice with your own telecom provider in the Microsoft Entra admin center instead of the API-based setup guide.
Cross-product topic
Authentication
A cross-product view of Microsoft Entra changes related to Authentication.
Latest Authentication changes
Choose Your Own Telephony Reliability
Authentication
The article now links to instructions for setting up SMS and voice with your own telecom provider in the Microsoft Entra admin center instead of the API-based setup guide.
Choose Your Own Telephony Troubleshoot
Authentication
The troubleshooting page’s setup link was updated from API-based instructions to instructions for setting up SMS and voice with your own telecom provider in the Microsoft Entra admin center.
Phone Providers
Authentication
The documentation now links Infobip’s Microsoft Security Store offer and directs administrators to the Microsoft Entra admin center setup guide instead of the API setup guide.
Set up SMS and voice with your own telecom provider in the Microsoft Entra admin center
Authentication
The documentation adds an end-to-end guide for purchasing and activating a telecom provider, deploying the Azure integration, configuring authentication method profiles, validating evaluation mode, and gradually rolling out SMS and voice delivery.
Set Up Sms Voice Api
Authentication
The article describing CYOT provider purchase, Azure integration deployment, permissions, policy configuration, and testing is no longer documented at this location.
(Update)Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants
Authentication
Starting March 2026, Microsoft Entra ID will GA passkey profiles and synced passkeys for tenants with Passkeys (FIDO2) enabled. Existing tenants will be auto-migrated to a default passkey profile with configurable passkeyType. Registration campaign settings and rollout timelines vary by cloud region.
Choose Your Own Telephony Fraud Costs
Authentication
The documentation link for monitoring and troubleshooting SMS and voice with your own telecom provider now points to the custom-telephony troubleshooting page.
Choose your own telephony provider for SMS and voice authentication
Authentication
The article now explains CYOT architecture, Azure Function integration, supported providers, and planning considerations such as coverage, pricing, fraud protection, resiliency, and costs.
Choose Your Own Telephony Reliability
Authentication
The monitoring and troubleshooting references now point to the dedicated choose-your-own-telephony troubleshooting page.
Microsoft Entra External ID credential management API reference
Authentication
The documentation now covers using the Microsoft Entra External ID credential management API to let signed-in customers list, register, and delete passkeys, including setup, permissions, authentication, and endpoint details.
Microsoft Entra: Choose your own telephony provider now generally available
Authentication
Microsoft Entra ID now generally supports Choose Your Own Telephony Provider (CYOT) for SMS and voice authentication, retiring Microsoft-provided services by February 1, 2027. Organizations must select a provider, set up CYOT, and transition before that date, while Microsoft recommends phishing-resistant methods like passkeys.
Phone Providers
Authentication
The phone providers documentation now links SMS and voice troubleshooting guidance to the dedicated `choose-your-own-telephony-troubleshoot.md` page.
Plan for resiliency and high availability
Authentication
The documentation explains CYOT delivery dependencies and resiliency approaches, including multi-region Azure Front Door deployments, secondary telecom providers, failover testing, capacity planning, and associated costs.
Protect against telephony fraud with your own telecom provider
Authentication
A new article explains how to configure telecom-provider fraud, destination, channel, spending, and alert controls; secure the CYOT integration; monitor activity; and respond to suspected fraud.
Set up SMS and voice
Authentication
The article now uses a shorter title and consolidated guidance emphasizing that CYOT updates the existing SMS or voice policy, may affect current users, and requires preserving production `includeTargets`. It also recommends saving the current policy JSON and using a test tenant for alternate targeting.
Set up SMS and voice with your own telecom providers
Authentication
The new guide explains how to connect Microsoft Entra SMS and voice authentication to a telecom provider using CYOT, including purchasing, Azure deployment, permissions, policy configuration, testing, and rollout.
Set Up Sms Voice Api
Authentication
The SMS/voice API setup documentation now links its rollout and diagnostic references to the choose-your-own-telephony troubleshooting page.
Sign In With Passkey
Authentication
The documentation now points to the credential management API for signed-in customers to list, register, and delete their own passkeys with delegated permissions. It also adds a sample and warns that its deletion flow is for test tenants only.
SMS-based user sign-in for Microsoft Entra ID
Authentication
The documentation states that Microsoft-provided SMS and voice authentication, including SMS first-factor sign-in, retires on February 1, 2027. It also updates the setting label to “Enable first factor sign-in” and notes automatic disabling after 30 days without traffic.
Troubleshoot MFA voice call and SMS problems
Authentication
The article now covers general Microsoft Entra MFA SMS and voice problems, including telecom delivery, Microsoft’s visibility, and investigation using correlation IDs and timestamps. CYOT-specific troubleshooting content was replaced, and phishing-resistant alternatives are recommended.
Troubleshoot SMS and voice with your own telecom provider
Authentication
The documentation explains how to trace Choose Your Own Telephony Provider requests across Microsoft Entra audit logs, sign-in logs, Function App logs, and the telecom provider portal, including relevant fields and queries.
Troubleshoot SMS and voice with your own telecom provider
Authentication
The article now explains how to trace Choose Your Own Telephony Provider requests through Microsoft Entra audit and sign-in logs, Function App logs, and the telecom provider portal.
Combined registration for SSPR and Microsoft Entra multifactor authentication
Authentication
Organizations can allow users to change cloud passwords after authenticating with a registered FIDO2 passkey or Windows Hello for Business credential, without knowing the current password or using SSPR. Temporary Access Pass isn't supported unless the user knows the existing password.
Entitlement Management Scenarios
Authentication
The entitlement management scenarios documentation no longer labels “Govern access for agents” as preview.
Microsoft Authenticator: Usability improvements for iOS and Android
Authentication
Microsoft Authenticator for iOS and Android will receive usability updates starting November 2026, including a refreshed home experience, clearer account restoration guidance, improved sign-in flows, and platform-specific prompts. Android improvements for restoration and battery optimization prompts will follow in January 2027. No action required.
Microsoft Entra ID Governance integrations
Authentication
The Entra ID Governance integrations table now lists Secure Cloud and distinguishes Zscaler ZSNet from Zscaler with separate links.
Microsoft Entra ID Governance integrations
Authentication
The overview page now uses a more specific section link and clearer descriptions of automated provisioning, SSO just-in-time provisioning, and additional application integrations.
Microsoft Entra ID: Risk-based anti-bot verification (CAPTCHA) for SMS and voice authentication
Authentication
Microsoft Entra ID is adding risk-based CAPTCHA verification for SMS and voice first-factor sign-ins to reduce automated abuse. Rollout began mid-October 2026. Some users may encounter this step based on behavior. Organizations should prepare help desks, review network requirements, and encourage phishing-resistant methods like passkeys.
Registration Mfa Sspr Combined
Authentication
The documentation section describing password changes after sign-in with CBA, FIDO2 passkeys, or Authenticator passwordless notifications was revised.
Registration Mfa Sspr Combined
Authentication
The documentation now uses the exact name of the secure sign-in setting related to changing cloud passwords after passwordless sign-in.
Registration Mfa Sspr Combined
Authentication
The documentation updates the name of the password-change flow available after CBA, passkey, or Authenticator passwordless sign-in.
Registration Mfa Sspr Combined
Authentication
The combined MFA and SSPR registration documentation updates its passwordless sign-in reference with a link to the relevant passwordless documentation.
Registration Mfa Sspr Combined
Authentication
The documentation now lists certificate-based authentication, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change their cloud password without entering their current password.
Self-service password reset deep dive
Authentication
The documentation now explains how users can change Microsoft Entra cloud passwords with FIDO2 passkeys or Windows Hello for Business, including the tenant-wide setting required to enable the experience and its limitation for on-premises password writeback.
Sspr Howitworks
Authentication
The documentation now states that rollout across all clouds begins in late October 2026 and is expected to finish by the end of November 2026.
Sspr Howitworks
Authentication
The page now labels the section “Allow password change after secure sign-in” and its subsection “Enable the setting,” replacing the previous “Passwordless authentication” heading.
Sspr Howitworks
Authentication
The heading “Allow password change after secure sign-in” now ends with a period.
Sspr Howitworks
Authentication
The documentation updates the section heading and setting label to “Allow password change after secure sign-in.”
Sspr Howitworks
Authentication
The documentation now states that users need a Microsoft Entra ID P1 or P2 license to use this feature.
Sspr Howitworks
Authentication
The documentation now explains where passwords are updated for cloud-only, hybrid with password writeback, and on-premises-only environments.
Sspr Howitworks
Authentication
In hybrid environments, password changes made with passwordless authentication can be written to an on-premises directory when password writeback is configured.
Sspr Howitworks
Authentication
The documentation now lists Microsoft Entra CBA, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change a cloud password without entering the current password.
Microsoft Entra: Prepare for Microsoft to disable unused or unsuccessful SMS first-factor sign-in
Authentication
Microsoft will disable SMS first-factor sign-in in Microsoft Entra tenants with no successful or only unsuccessful SMS sign-ins in the past 30 days, starting mid-September to November 2026. SMS for MFA and password reset remains unaffected. Admins should review usage, notify users, and ensure alternate sign-in methods.
Support passkeys in Authenticator in your Microsoft Entra ID tenant
Authentication
The guidance now documents provisioning the Microsoft Authenticator Credential Registration enterprise application and excluding it from Conditional Access policies scoped to All resources to unblock passkey registration.
Microsoft Authenticator: Improved backup and restore experience for Android
Authentication
Microsoft Authenticator for Android will improve backup and restore with clearer setup guidance and support for passkeys starting mid-January 2027. Users must enable Google One backup and screen lock. Work/school accounts aren’t backed up, and backup works only in the Android personal profile. No admin action needed.
Microsoft Entra ID: Reminder to migrate from Microsoft-provided SMS and voice authentication
Authentication
Microsoft Entra ID will retire Microsoft-provided SMS and voice authentication starting February 1, 2027. Organizations must migrate users to passkeys or other methods, or configure a customer-managed telecom provider before then to avoid sign-in disruptions. SMS and voice are vulnerable to attacks; passkeys are recommended.
System-preferred authentication in Microsoft Entra ID
Authentication
The article now explains that system-preferred authentication considers the user’s current device and browser, prioritizes accessible local passkeys, and handles device-bound credentials such as Windows Hello for Business and macOS Platform SSO by platform.
Configure Microsoft Entra Kerberos trust
Authentication
The documentation now explains that the Trusted Domain Object creates an inbound trust from the AD DS domain’s perspective. It also notes that this object isn’t required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in; those scenarios require only the Microsoft Entra Kerberos server object.
Configure Microsoft Entra Kerberos trust
Authentication
The documentation now explains that the trust creates a Trusted Domain Object for the Microsoft Entra Kerberos realm and is inbound from the AD DS perspective. It also clarifies that the object isn't required for Windows Hello for Business cloud Kerberos trust or FIDO2 sign-in.
Macos Platform Sso Architecture
Authentication
The documentation now explains Password, UserSecureEnclaveKey, and SmartCard registration and authentication flows, including credential handling, device proof, and PRT issuance. It also recommends UserSecureEnclaveKey for most deployments.
Mfa Number Match
Authentication
The documentation now shows an updated Android screenshot and describes selecting Approve or Deny instead of Yes or No for relevant number-matching prompts in Authenticator, Teams, and Outlook.
Device Join Macos Platform Single Sign On Kerberos Configuration
Authentication
The documentation expands access from limited availability and updates setup links. It also clarifies that the storage account app registration must use a lowercase `cifs` identifier URI for SMB mounting on macOS.
Architecture and authentication flow for macOS Platform SSO with Microsoft Entra ID
Authentication
The page title was simplified, and the role descriptions now state that the Microsoft Enterprise SSO plug-in performs device and user registration with Microsoft Entra ID. Microsoft Entra ID is described as verifying credentials and proofs and issuing the PRT.
Add Microsoft Entra ID for customer sign-in
Authentication
The FAQ now states that identity provider buttons cannot be hidden. Removing a provider from a user flow prevents users from signing up or redeeming invitations with that provider, and `domain_hint` does not change this.
Add OIDC for customer sign-in
Authentication
The page now explains self-service sign-up through a user flow and invitation redemption through a custom OIDC provider using the domain_hint authorization parameter.
Architecture and authentication flow for macOS Platform SSO (Apple) with Microsoft Entra ID
Authentication
Microsoft added a conceptual guide describing macOS Platform SSO registration, Secure Enclave device keys, the Platform SSO PRT, app SSO, and the roles of MDM, macOS, the Microsoft Enterprise SSO plug-in, and Microsoft Entra ID.
Connector Groups
Authentication
The documentation adds Performance mode, which routes user traffic to the connector with the lowest measured network latency. It also clarifies that connector load balancing applies only to Microsoft Entra Private Access applications, not application proxy applications.
Disable sign-up in a sign-up and sign-in user flow
Authentication
The article now highlights testing the user flow as the primary next step and adds links for adding applications, managing custom attributes, and routing invited users to an external identity provider.
Disable user sign-in for application
Authentication
The article now explains that disabling sign-in sets the service principal’s `accountEnabled` property to `false` and changes Activation status to Deactivated. It also adds steps to restore tenant-local sign-in and notes that other deactivation conditions can still apply.
Identity Protection Risks
Authentication
The documentation now describes adaptive learning for new users’ sign-in behavior and says detection is calculated in real time, replacing the previous learning-period and offline-calculation details.
Risk-based anti-bot verification (CAPTCHA) for telephony-based sign-in
Authentication
The documentation explains when users may encounter Arkose Labs anti-bot verification before receiving SMS messages or voice calls, including user experience, network requirements, and help-desk guidance.
Add Microsoft Entra ID for customer sign-in
Authentication
The documentation now specifies tenant ID or the tenant’s onmicrosoft.com domain for the issuer URI, says custom verified domains aren’t supported, and requires matching onmicrosoft.com values for domain_hint. It also documents steps to refresh a user flow after provider configuration changes.
Security Defaults
Authentication
The documentation describes four separately manageable protections—administrator MFA, user MFA, legacy authentication blocking, and device code flow blocking—for selected Microsoft Entra ID Free tenants. It also explains how these protections work with Conditional Access and which roles can manage them.
Microsoft Entra: Allow password change after secure sign-in with My Sign-Ins
Authentication
Microsoft Entra will enable users to change passwords after secure sign-in using strong credentials (passkey, FIDO2, Windows Hello) without knowing the current password or using SSPR. This feature, disabled by default, requires admin activation and will roll out globally from October to November 2026.
Microsoft Entra: Changes to AgentIdentity.CreateAsManager permission for agent identities
Authentication
Starting November 4, Microsoft Entra will stop automatically granting the AgentIdentity.CreateAsManager permission to agent blueprints. Admin consent will be required for agents to create identities. This change, rolling out worldwide in November 2026, enhances control and auditability of agent identity creation.
Enable Authenticator Passkey
Authentication
The documentation now states that iOS users can register attested passkeys only directly in the Authenticator app, while Android users can register them directly or through cross-device registration.
Enable Authenticator Passkey
Authentication
The documentation now states that Android users can register attested passkeys directly in the Authenticator app or through a cross-device registration flow. iOS registration remains direct through the Authenticator app.
Enable Authenticator Passkey
Authentication
The documentation now separately states that Android users can register attested passkeys through a cross-device registration flow, while iOS users register them directly in the Authenticator app.
Enable Authenticator Passkey
Authentication
The documentation now states that iOS cross-device registration does not support attestation, while Android does. Attested passkeys can also be registered through Android cross-device flows.
Mfa Registration Campaign
Authentication
The example now specifies a device-bound profile with attestation enforced and an eligible attested passkey. It states that the nudge is suppressed across operating systems and browsers, without using the platform table.
Mfa Registration Campaign
Authentication
The example now explicitly states that User 1 signs in on macOS with Chrome and is nudged to register a compatible passkey.
Mfa Registration Campaign
Authentication
The example now specifies that the user’s only registered passkey is Windows Hello for Business; the nudge is suppressed when they sign in on Windows with Chrome.
Mfa Registration Campaign
Authentication
The documentation now refers to registered passkeys and available passkey types instead of credentials in the platform-specific nudge suppression guidance and table.
Mfa Registration Campaign
Authentication
The documentation now states that Windows Hello for Business registration doesn’t follow passkey profile restrictions.
Mfa Registration Campaign
Authentication
The documentation now states that Windows Hello for Business registration behavior is separate from passkey profile restrictions.
Mfa Registration Campaign
Authentication
The MFA registration campaign documentation now links directly to the passkey profile eligibility guidance for the Microsoft managed registration campaign.
Mfa Registration Campaign
Authentication
The documentation explains how unrestricted, synced-only, and device-bound-only profiles use platform-specific evaluation, while AAGUID-restricted and attestation-enforced profiles suppress nudges across platforms after one eligible passkey is registered.
Mfa Registration Campaign
Authentication
The documentation now states that eligible users can see nudges during interactive sign-ins that satisfy MFA. Silent SSO events, such as refresh token redemption, do not display nudges.
Configure Microsoft Entra Kerberos trust
Authentication
The documentation now covers prerequisites, PowerShell module installation, Trusted Domain Object creation, client ticket configuration, key rotation, and trust removal.
Howto Investigate Health Scenario Alerts
Authentication
The health scenario alerts guide now links to guidance for Agent ID interactive sign-ins and autonomous sign-ins.
Investigate Agent ID autonomous sign-ins
Authentication
Adds a how-to article explaining Health Monitoring signals and alerts, log correlation, impact criteria, troubleshooting, and prerequisites for autonomous agent sign-ins. The monitoring and alerts are documented as being in preview.
Investigate Agent ID interactive sign-ins
Authentication
A new how-to explains how to interpret Health Monitoring signals, correlate agent properties with sign-in and audit logs, and mitigate common failures. It also identifies the relevant non-interactive sign-in logs and documents licensing and role prerequisites.
Kerberos Server Key Rotation
Authentication
The standalone article describing Kerberos server-key rotation, prerequisites, dual-key behavior, and the Set-AzureADKerberosServer procedure was deleted.
Whats New
Authentication
The documentation states that generally available key rotation improves reliability for incoming trust referral flows and addresses authentication failures caused when referral tickets used a secondary key.
Run a registration campaign to set up a passkey or Microsoft Authenticator
Authentication
The article no longer states that the registration campaign rollout is expected to finish by the end of September 2026 or that tenant experiences may differ during the rollout.
System-preferred authentication in Microsoft Entra ID
Authentication
The article date was updated to October 7, 2026, and the note about gradual Microsoft-managed deployment through September 2026 was removed.
Microsoft Entra ID attestation for FIDO2 security key vendors
Authentication
The documentation now references MDS version 285 instead of 279 and adds five FIDO2 security key models with their AAGUIDs and capability indicators.
Acquire a token to call a web API using username and password (desktop app)
Authentication
The username/password token acquisition article no longer includes the author, manager, and ms.author fields.
Add custom headers to native authentication requests in Android (Kotlin)
Authentication
The Android custom headers tutorial no longer includes the author, manager, and ms.author metadata fields.
Authentication Entra Passkeys On Windows
Authentication
The page no longer includes the `ms.author: justinha` metadata entry.
Deployment External Authentication Access Control
Authentication
The article fixes the spelling of “OpenID Connect” and replaces an empty .NET NuGet link with an Azure Functions API link, along with other wording corrections.
Faq Customers
Authentication
The documentation now states that SMS is unavailable only for first-factor authentication in external tenants, indicating availability for self-service password reset. SMS remains available for second-factor verification at additional cost.
Mandatory multifactor authentication for Azure and admin portals
Authentication
The article was edited for spelling, headings, and presentation while retaining its documented enforcement phases, dates, affected applications, account scope, and break-glass guidance.
Microsoft Entra External ID app samples and guides
Authentication
The page title and description now use Microsoft Entra External ID terminology. Passkey sample links were updated from listing and registration to sign-in and management, and the sample table was revised.
Native authentication API reference documentation
Authentication
The native authentication API reference was updated with spelling corrections. The supplied examples, links, endpoints, error details, and configuration guidance remain unchanged.
Self-service password reset deep dive
Authentication
The guidance now states that Microsoft Authenticator, software OATH tokens, and hardware OATH tokens count as one authentication method for SSPR, regardless of Authentication methods policy migration status.
Sign in to Microsoft Entra Connect Sync by using passwordless authentication
Authentication
The passwordless authentication documentation no longer includes the `author` and `ms.author` fields.
Sign In With Passkey
Authentication
The documentation now describes a sample where signed-in customers list and register their own passkeys. It warns that the deletion flow uses high-privilege permissions and a client secret, so the sample is for test tenants only.
Sign in with passkeys in Microsoft Entra External ID
Authentication
The page now describes administrator-controlled passkey provisioning with the FIDO2 provisioning APIs and identifies the sample as testing-only with high-privilege permissions.
Sso Admin Control
Authentication
The documentation fixes minor formatting in the scope notes and corrects the image text from `HKEY_LOCAL_MACHIEN` to `HKEY_LOCAL_MACHINE`.
Tutorial Native Authentication Single Page App React Sdk Sign In
Authentication
The tutorial’s code comment was corrected from “Thge” to “The” and from “rquired” to “required.”
Microsoft Entra External ID credential management API reference
Authentication
Microsoft Entra External ID applications can use the credential management API to let signed-in customers list and register passkeys. The reference covers delegated authentication, permissions, and setup.
Sign In With Passkey
Authentication
The documentation now directs applications to use the credential management API, with low-privilege delegated permissions, so signed-in customers can list and register their own passkeys.
Configure workload identity-based authentication for SAP SuccessFactors provisioning
Authentication
The guide removes the Preview label and documents that workload identities are reusable only when their Application API host matches the provisioning app’s SAP SuccessFactors API host. It also adds the Application ID URI format and compatibility details for the September 15, 2026 update.
Configure Zscaler Authentication Service Provisioning for automatic user provisioning with Microsoft Entra ID
Authentication
The tutorial replaces references to Zidentity and Zscaler Provisioning with Zscaler Authentication Service and updates related titles, prerequisites, app-role guidance, and provisioning steps. The page date was also updated.
Agent Users
Authentication
The documentation now states that agent user accounts can be assigned custom roles, while privileged administrator roles remain restricted.
Deploy Phishing Resistant Passwordless Authentication
Authentication
The documentation corrects an internal section link and improves grammar, spelling, punctuation, and wording throughout the rollout guidance.
Introduction to Microsoft Entra Kerberos
Authentication
The page now describes how Windows Hello for Business cloud Kerberos trust uses Microsoft Entra Kerberos to provide passwordless access to Active Directory resources and links to a deployment guide.
Kerberos
Authentication
The documentation now states that users accessing Active Directory-protected resources need corresponding Active Directory accounts. Cloud-managed users should be provisioned from Microsoft Entra ID, including required group memberships.
Kerberos
Authentication
The page now explains how Microsoft Entra ID users and groups provisioned to Active Directory with Cloud Sync can access Kerberos-protected resources through Microsoft Entra Kerberos, Windows Hello for Business, or FIDO2. It also clarifies that provisioning alone does not enable Kerberos or passwordless access.
Sspr Howitworks
Authentication
The SSPR documentation now refers to a “Microsoft Entra administrator role” instead of an “Azure administrator role” when describing enforcement of the strong two-gate password policy.
Backup Authentication System
Authentication
The backup authentication system documentation no longer lists Workplace from Facebook in its integration table.
Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection
Authentication
Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026. Only trusted Microsoft scripts will run, affecting organizations using script-injecting tools on login.microsoftonline.com. No action needed if such tools aren't used.
Provision On Demand
Authentication
The provision-on-demand article no longer includes references to Meta Workplace. The displayed guidance about stopping provisioning for OAuth-based applications remains unchanged.
Microsoft Entra ID attestation for FIDO2 security key vendors
Authentication
The Microsoft Entra FIDO2 hardware vendor documentation now references MDS version 279 instead of 275 and adds the FEITIAN FT-JCOS BioCard, including its AAGUID and feature capabilities. The page date was also updated.
How Provisioning To Active Directory Works
Authentication
The documentation now identifies affected accounts as cloud-managed users and explains that password writeback is unavailable for them. It also states that they can access Kerberos-based applications through passwordless authentication using the AD account created by provisioning.
How Provisioning To Active Directory Works
Authentication
The documentation now specifies that password writeback isn't available for users created in Microsoft Entra. These users can authenticate to Kerberos-based applications only through passwordless authentication using the provisioned AD account.
Choose a telephony provider for SMS and voice authentication
Authentication
The documentation now identifies Soprano and Telesign as initial providers and links to their commercial offers. Configuration begins October 30, 2026.