Daily.Entra.News
Aboutmerill.net
Microsoft Entra ID
Authentication

Troubleshoot SMS and voice with your own telecom provider

30 October 2026Generally available+124 / −55 lines

In brief

The article now explains how to trace Choose Your Own Telephony Provider requests through Microsoft Entra audit and sign-in logs, Function App logs, and the telecom provider portal.

What Entra admins need to know

Administrators can identify where delivery or integration failures occur and route issues to Microsoft Support, their Azure team, or their telecom provider. No action is required.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Troubleshoot MFA voice call and SMS problems

This article explains how to investigate and resolve problems with voice call or SMS sign-in methods for multifactor authentication (MFA). It explains how telecom delivery works behind the scenes, what Microsoft can and can't see, and what to expect during an investigation.

Move to modern, phishing-resistant authentication

How global telecom delivery works

Microsoft works with primary telecom providers that have global reach. These providers rely on their own networks of suppliers, who control the routes for SMS and voice calls through local end-carrier networks. This supply chain represents thousands of individual carriers and routes around the globe.with your own telecom provider

Microsoft maintains robust processesUse this article to help ensure successful delivery of everytrace SMS and voice MFA request. However, oncerequests end to end with Choose Your Own Telephony Provider (CYOT), find where a request leavesstopped, and contact the right team to resolve it: Microsoft network, delivery is delegated to externalsupport, your Azure team, or your telecom providers.provider.

These providers often share

How a CYOT request flows

Each request passes through four stages, and each stage is recorded in its own logs:

StageWhat happensWhere to look
1. Microsoft Entra sends the same end routes and carriers in a given destination country but might operate under different contractual agreements or traffic priorities. As a result, routing a request through a different provider doesn't always resolve the issue — the new request might follow the same downstream path and encounter the same obstacle.

The journey of

Microsoft Entra requires an SMS or voice MFA request

When you sign incode and an SMS or voice MFA challenge is triggered, Microsoft can confirm the following steps given a Correlation ID and timestamp:

  1. Request received. Microsoft Entra generates the MFA request and constructs the payload for the SMS or voice request with the expected Microsoft or company branding.
  2. Provider selected. Microsoft sends the request to one of multiple external third-party telecom providers matching your country code.
  3. Channel matched. The request is routed throughendpoint.
Microsoft Entra audit logs
2. Your endpoint processes itYour Function App receives the correct channel (SMS or voice) per your configuration, selection, and policy requirements.
  • Delivery confirmed. The provider confirms receipt of the telecom request and markssends it as successfully delivered with no alterations.

    • Afterto your telecom provider.

    		Function App logs
    3. Your provider delivers itYour provider sends the SMS message or voice call to the user's phone.Your provider confirms delivery,'s portal
    4. The user signs inThe user enters the code, and Microsoft Entra completes authentication.Microsoft Entra sign-in logs

    Find the request enters external telecom networks where Microsoft doesn't have direct visibility. Problems that occur beyond this point require collaboration with the provider to investigate.

    What can go wrong after delivery to the provider

    After the request reaches an external telecom provider, two types of problems can occur.

    The call or message is dropped or blocked

    The provider should confirm this issue to Microsoft. Common causes include:

    • Device-level configuration. Even when all steps to send the message are correct, the device itself could refuse the call or route it to voicemail. Microsoft automatically retries these failures across different providers.
    • Carrier-level blocking. The carrier might block the call or message due to international automated fraud detection systems.
    • Regional availability issues. In rare cases, the message is dropped due to availability issues in a specific country. Microsoft and its providers have robust retry and reroute mechanisms for these scenarios and post automated outage communications when the impact is broadly reported.

    The call or message is altered by a downstream carrier

    Because the provider already confirmed delivery, Microsoft can only see a successful delivery per its specification. When message content is altered:

    • The customer should provide evidence that the message received on their device didn't appear with the expected branding or channel.
    • Microsoft collaborates with the provider to understand the end-carrier behavior taken on behalf of the request.
    • The provider will likely correct the route for the affected country code or phone number to avoid carriers that aren't honoring the original message contract.

    What to expect during an investigationaudit logs

    Due to the complexity of global telecom routing and limited visibility beyond the provider, telecom delivery investigations involve coordination across multiple companies and stakeholders.

    Timeline

    Investigations into downstream customer-reported delivery issues can take 4–6 weeks. The provider checks their logs and, if no issue is found locally, queries downstream partners who might use additional providers.

    Root cause analysis (RCA) policy

    Microsoft doesn't publish RCAs for issues that originate with external telecom providers. Carriers often don't share root cause details with Microsoft due to international visibility and competitive agreements.

    Help with the investigation

    To help Microsoft Support investigate provider-related issues:

    • Submit a Correlation ID and timestamp for the sign-ins that need investigation. You can find these values in the sign-in logs. The Correlation ID returns all Request IDs associated with the sign-in.

      To view the sign-in logs from the Microsoft Entra admin center:

      1. Sign in to the Microsoft Entra admin center as at least a Reports ReaderReports Reader.
      2. Go to Entra ID > Monitoring & health > Audit logs, and select the Directory tab.
      3. Set the Date range, and add these filters: Service: Azure MFA and Category: Authentication.
      4. BrowseLeave Activity set to All so you see both successful and failed requests.

      :::image type="content" source="media/troubleshoot-voice-call-sms/audit-logs.png" alt-text="Screenshot of Audit logs filtered by Service Azure MFA and Category Authentication, showing CyotDeliverySucceeded and CyotDeliveryFailed activities." lightbox="media/troubleshoot-voice-call-sms/audit-logs.png":::

      Select the request to open Audit Log Details, and note these values:

      FieldWhat it tells you
      Activity TypeCyotDeliverySucceeded means your endpoint accepted the request. CyotDeliveryFailed means it didn't complete.
      DeliveryMethodCyot for a live request through your provider. CyotEvaluation for an evaluation request.
      ChannelSms or Voice.
      AuthenticationMethodThe method used, such as OneWaySms or OneWayVoiceMobileOtp.
      Correlation IDThe identifier to share with support.
      FailureReasonWhy a failed request didn't complete.

      :::image type="content" source="media/troubleshoot-voice-call-sms/audit-log-details.png" alt-text="Screenshot of Audit Log Details for CyotDeliverySucceeded with DeliveryMethod Cyot and Channel Voice." lightbox="media/troubleshoot-voice-call-sms/audit-log-details.png":::

      Check sign-in logs

      Use sign-in logs to confirm whether the user completed authentication.

      1. Go to Entra ID > Monitoring & health > Sign-in logs.
      2. Find the sign-in by user and time, and open it.
      3. On Authentication Details, review the method, whether the step succeeded, and the result detail.

      :::image type=Sign-in logs show the method as Text message or Voice. To confirm that the request was sent through your provider, use audit logs.

      Check Function App logs

      Use your Function App logs to see how your endpoint processed the request and what it returned to Microsoft Entra.

      1. In the Azure portal, open the Function App created by setup.

      2. Go to Monitoring > Application Insights, and open the linked Application Insights resource.

      3. Select Logs, and run the following query for the time of the attempt:

        AppRequests
| where TimeGenerated > ago(1h)
| where Url has "content/api/SendOtp"
source="media/troubleshoot-voice-call-sms/sign-in-log-correlation-id.png" alt-text="Screenshot| project TimeGenerated, ResultCode, Success, DurationMs, OperationId
| order by TimeGenerated desc

      ResultCode shows what your Function App returned to Microsoft Entra. To see your provider's response for the same request, query AppTraces with its OperationId.

      Identify who can help

      Use what you see in audit logs to find the right contact.

      What you seeWhat to checkContact
      No CYOT activity in audit logsConfirm the date range and filters, that shows the Dateuser is included in SMS or voice targeting, and Correlation ID fieldsthat a new phone challenge was required.Microsoft support
      Only CyotEvaluation activityThe profile is inEvaluation. Switch to Production to route traffic through your provider.No support needed
      CyotDeliveryFailed with EndpointClientErrorYour endpoint rejected the request. Check your Function App logs and authentication settings.Your Azure team
      CyotDeliveryFailed with EndpointServerErrorYour endpoint returned an error or didn't respond in time. Check your Function App logs and your provider's status.Your Azure team
      CyotDeliveryFailed with NonceMismatchYour endpoint's response didn't match what Microsoft Entra expects. Compare any customizations with the CYOT sample.Your Azure team
      CyotDeliverySucceeded, but the user didn't receive the codeYour endpoint accepted the request. Check your provider's delivery records.Your telecom provider
      The user received the code, but sign-in failedCheck the sign-in logs for an expired, reused, or incorrect code.Microsoft support
      Delivery blocked to certain countries/regions, fraud blocks, or unexpected chargesReview your provider's fraud, destination, and spending controls.Your telecom provider

      Contact support

      ContactCoversHow to reach
      Microsoft supportAuthentication method policy, Microsoft Entra authentication, and the request to your endpointGet support for Microsoft Entra
      Your Azure teamYour Function App, its configuration, and Azure resourcesInternal. For Azure platform issues, contact Azure support.
      Your telecom providerProvider account, delivery, fraud controls, and usage chargesSupport details in the Microsoft Entra admin center." lightbox="media/troubleshoot-voice-call-sms/sign-in-log-correlation-id.png":::provider's Microsoft Security Store listing

      Information to include

      • Tenant ID, channel (SMS or voice), and the UTC time of the attempt.

      • The audit log Provide fresh samples. End carriers often require Correlation IDs from the last 48–72 hours. Older requests may not propagate to the final end carrier in time for investigation. You may be asked to provide multiple samples.

        ID, DeliveryMethod, and FailureReason.

      • Provide evidence of altered messages. If the message you received didnYour provider't appear with the expected branding or channel, share a screenshot or description of what you received.

        s transaction ID, if available.
      • Any recent configuration changes.

      Related content

    Daily Entra.News

    Get daily email updates

    Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

    Loading the secure signup form…