Organizations that still rely on SMS and voice-based MFA may need to make some important decisions before Microsoft’s planned retirement dates arrive.
Key Takeaways:
Microsoft is preparing to phase out its own SMS and voice-based authentication services, forcing organizations that still rely on telephony-based multifactor authentication (MFA) to rethink how those users will sign in. The company continues to promote phishing-resistant methods such as passkeys, but some businesses face regulatory, operational, or technical requirements that make SMS and voice authentication difficult to eliminate entirely.
Starting on October 30, 2026, Microsoft Entra ID will support a new “Choose Your Own Telephony Provider” (CYOT) model. This feature allows organizations to select a supported telecommunications provider through the Microsoft Security Store to deliver authentication text messages and voice calls. Microsoft will continue managing authentication policies and the sign-in experience, while organizations will be responsible for contracting with and managing their preferred provider.
This change is driven by Microsoft’s broader effort to reduce reliance on less secure authentication methods. Microsoft-provided SMS and voice authentication services are scheduled for retirement on February 1, 2027, for most users, with Global Administrators and external users receiving an extension until July 1, 2027. Organizations that don’t migrate affected users to passkeys or another supported option risk creating sign-in disruptions. Users whose only MFA method is SMS or voice could encounter a mandatory, blocking prompt requiring passkey registration during authentication.
This transition gives organizations greater flexibility, but it also introduces new responsibilities. IT teams will need to identify users with legitimate telephony-based authentication requirements, evaluate whether phishing-resistant alternatives can meet those needs, and compare supported providers based on coverage, compliance, security capabilities, support services, and cost. They must also account for procurement processes, privacy requirements, Azure subscription prerequisites, and ongoing telephony expenses.
Organizations gain control over provider selection and service delivery, but they also inherit vendor management, purchasing, compliance reviews, and operational costs that were previously handled by Microsoft. For many organizations, this move will accelerate the transition toward passkeys and other phishing-resistant authentication methods, which will reserve SMS and voice authentication for users with specific business or regulatory constraints.
Follow
Rabia has a master’s degree in Software Engineering and she has years of experience writing professionally about Microsoft products and other technologies. Rabia has also written for OnMSFT.com as well as Windows Report. She is always up to date on t…
Create a free account today to participate in forum conversations, comment on posts and more.

source