Daily.Entra.News
Aboutmerill.net
Microsoft Entra ID
Authentication

Troubleshoot MFA voice call and SMS problems

30 October 2026Doc update+55 / −124 lines

In brief

The article now covers general Microsoft Entra MFA SMS and voice problems, including telecom delivery, Microsoft’s visibility, and investigation using correlation IDs and timestamps. CYOT-specific troubleshooting content was replaced, and phishing-resistant alternatives are recommended.

What Entra admins need to know

Use the revised guidance when investigating delivery issues and consider the listed stronger authentication methods. No administrator action is required.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Troubleshoot MFA voice call and SMS problems

This article explains how to investigate and resolve problems with voice call or SMS sign-in methods for multifactor authentication (MFA). It explains how telecom delivery works behind the scenes, what Microsoft can and can't see, and what to expect during an investigation.

Move to modern, phishing-resistant authentication

How global telecom delivery works

Microsoft works with primary telecom providers that have global reach. These providers rely on their own networks of suppliers, who control the routes for SMS and voice with your own telecom provider

calls through local end-carrier networks. This supply chain represents thousands of individual carriers and routes around the globe.

Use this articleMicrosoft maintains robust processes to tracehelp ensure successful delivery of every SMS and voice requests end to end with Choose Your Own Telephony Provider (CYOT), find whereMFA request. However, once a request stopped,leaves the Microsoft network, delivery is delegated to external telecom providers.

These providers often share the same end routes and contactcarriers in a given destination country/region but might operate under different contractual agreements or traffic priorities. As a result, routing a request through a different provider doesn't always resolve the right team to resolve it: Microsoft support, your Azure team, or your telecom provider.

issue — the new request might follow the same downstream path and encounter the same obstacle.

How a CYOT request flows

Each request passes through four stages, and each stage is recorded in its own logs:

StageWhat happensWhere to look
1. Microsoft Entra sends the requestMicrosoft Entra requiresThe journey of an SMS or voice codeMFA request

When you sign in and an SMS or voice MFA challenge is triggered, Microsoft can confirm the following steps given a Correlation ID and timestamp:

  1. Request received. Microsoft Entra generates the MFA request and constructs the payload for the SMS or voice request with the expected Microsoft or company branding.
  2. Provider selected. Microsoft sends the request to one of multiple external third-party telecom providers matching your endpoint.
country code.
  • Channel matched. The request is routed through the correct channel (SMS or voice) per your configuration, selection, and policy requirements.
  • Delivery confirmed. The provider confirms receipt of the telecom request and marks it as successfully delivered with no alterations.

    • After the provider confirms delivery, the request enters external telecom networks where Microsoft doesn't have direct visibility. Problems that occur beyond this point require collaboration with the provider to investigate.

    What can go wrong after delivery to the provider

    After the request reaches an external telecom provider, two types of problems can occur.

    The call or message is dropped or blocked

    The provider should confirm this issue to Microsoft. Common causes include:

    • Device-level configuration. Even when all steps to send the message are correct, the device itself could refuse the call or route it to voicemail. Microsoft automatically retries these failures across different providers.
    • Carrier-level blocking. The carrier might block the call or message due to international automated fraud detection systems.
    • Regional availability issues. In rare cases, the message is dropped due to availability issues in a specific country/region. Microsoft and its providers have robust retry and reroute mechanisms for these scenarios and post automated outage communications when the impact is broadly reported.

    The call or message is altered by a downstream carrier

    Because the provider already confirmed delivery, Microsoft can only see a successful delivery per its specification. When message content is altered:

    • The customer should provide evidence that the message received on their device didn't appear with the expected branding or channel.
    • Microsoft collaborates with the provider to understand the end-carrier behavior taken on behalf of the request.
    • The provider will likely correct the route for the affected country code or phone number to avoid carriers that aren't honoring the original message contract.

    What to expect during an investigation

    Due to the complexity of global telecom routing and limited visibility beyond the provider, telecom delivery investigations involve coordination across multiple companies and stakeholders.

    Timeline

    Investigations into downstream customer-reported delivery issues can take 4–6 weeks. The provider checks their logs and, if no issue is found locally, queries downstream partners who might use additional providers.

    Root cause analysis (RCA) policy

    Microsoft doesn't publish RCAs for issues that originate with external telecom providers. Carriers often don't share root cause details with Microsoft due to international visibility and competitive agreements.

    Help with the investigation

    To help Microsoft Support investigate provider-related issues:

    • Submit a Correlation ID and timestamp for the sign-ins that need investigation. You can find these values in the sign-in logs. The Correlation ID returns all Request IDs associated with the sign-in.

      To view the sign-in logs from the Microsoft Entra audit logs

    2. Your endpoint processes itYour Function App receives the request and sends it to your telecom provider.Function App logs
    3. Your provider delivers itYour provider sends the SMS message or voice call to the user's phone.Your provider's portal
    4. The user signs inThe user enters the code, and Microsoft Entra completes authentication.Microsoft Entra sign-in logs

    Find the request in audit logs

    admin center:

    1. Sign in to the Microsoft Entra admin center as at least a Reports Reader.
    2. Go to Entra ID > Monitoring & health > Audit logs, and select the Directory tab.
    3. Set the Date range, and add these filters: Service: Azure MFA and Category: AuthenticationReports Reader.
    4. Leave Activity set to All so you see both successful and failed requests.

    :::image type="content" source="media/troubleshoot-voice-call-sms/audit-logs.png" alt-text="Screenshot of Audit logs filtered by Service Azure MFA and Category Authentication, showing CyotDeliverySucceeded and CyotDeliveryFailed activities." lightbox="media/troubleshoot-voice-call-sms/audit-logs.png":::

    Select the request to open Audit Log Details, and note these values:

    FieldWhat it tells you
    Activity TypeCyotDeliverySucceeded means your endpoint accepted the request. CyotDeliveryFailed means it didn't complete.
    DeliveryMethodCyot for a live request through your provider. CyotEvaluation for an evaluation request.
    ChannelSms or Voice.
    AuthenticationMethodThe method used, such as OneWaySms or OneWayVoiceMobileOtp.
    Correlation IDThe identifier to share with support.
    FailureReasonWhy a failed request didn't complete.

    :::image type="content" source="media/troubleshoot-voice-call-sms/audit-log-details.png" alt-text="Screenshot of Audit Log Details for CyotDeliverySucceeded with DeliveryMethod Cyot and Channel Voice." lightbox="media/troubleshoot-voice-call-sms/audit-log-details.png":::

    Check sign-in logs

    Use sign-in logs to confirm whether the user completed authentication.

    1. GoBrowse to Entra ID > Monitoring & health > Sign-in logs.
    2. Find

    :::image type="content" source="media/troubleshoot-voice-call-sms/sign-in-log-correlation-id.png" alt-text="Screenshot that shows the sign-in by userDate and time, and open it.

  • On Authentication Details, review the method, whether the step succeeded, and the result detail.

    • Sign-Correlation ID fields in logs show the method as Text message or Voice. To confirm that the request was sent through your provider, use audit logs.

    Check Function App logs

    Use your Function App logs to see how your endpoint processed the request and what it returned to Microsoft Entra.

    1. In the Azure portal, open the Function App created by setup.

    2. Go to Monitoring > Application Insights, and open the linked Application Insights resource.

    3. Select Logs, and run the following query for the time of the attempt:

      AppRequests
| where TimeGenerated > ago(1h)
| where Url has "/api/SendOtp"
| project TimeGenerated, ResultCode, Success, DurationMs, OperationId
| order by TimeGenerated desc

    ResultCode shows what your Function App returned to Microsoft Entra. To see your provider's response for the same request, query AppTraces with its OperationId.

    Identify who can help

    Use what you see in audit logs to find the right contact.

    What you seeWhat to checkContact
    No CYOT activity in audit logsConfirm the date range and filters, that the user is included in SMS or voice targeting, and that a new phone challenge was required.Microsoft support
    Only CyotEvaluation activityThe profile is in Evaluation. Switch to Production to route traffic through your provider.No support needed
    CyotDeliveryFailed with EndpointClientErrorYour endpoint rejected the request. Check your Function App logs and authentication settings.Your Azure team
    CyotDeliveryFailed with EndpointServerErrorYour endpoint returned an error or didn't respond in time. Check your Function App logs and your provider's status.Your Azure team
    CyotDeliveryFailed with NonceMismatchYour endpoint's response didn't match what Microsoft Entra expects. Compare any customizations with the CYOT sample.Your Azure team
    CyotDeliverySucceeded, but the user didn't receive the codeYour endpoint accepted the request. Check your provider's delivery records.Your telecom provider
    The user received the code, but sign-in failedCheck the sign-in logs for an expired, reused, or incorrect code.Microsoft support
    Delivery blocked to certain countries/regions, fraud blocks, or unexpected chargesReview your provider's fraud, destination, and spending controls.Your telecom provider

    Contact support

    ContactCoversHow to reach
    Microsoft supportAuthentication method policy,in the Microsoft Entra authentication, andadmin center." lightbox="media/troubleshoot-voice-call-sms/sign-in-log-correlation-id.png":::

  • Provide fresh samples. End carriers often require Correlation IDs from the requestlast 48–72 hours. Older requests may not propagate to your endpoint

    		• Get support for Microsoft Entra
    Your Azure teamYour Function App, its configuration, and Azure resourcesInternal. For Azure platform issues, contact Azure support.
    Your telecom providerProvider account, delivery, fraud controls, and usage chargesSupport detailsthe final end carrier in the provider's Microsoft Security Store listing

    time for investigation. You may be asked to provide multiple samples.

    Information to include

    • Tenant ID, channel (SMS or voice), and the UTC time of the attempt.
    • The audit log

      Correlation IDProvide evidence of altered messages., DeliveryMethod, and FailureReason.

    • Your provider If the message you received didn's transaction ID, if available.
    • Any recent configuration changes.t appear with the expected branding or channel, share a screenshot or description of what you received.

    Related content

    Configure and enable users for SMS-based authentication using Microsoft Entra ID \ No newline at end of file

    Daily Entra.News

    Get daily email updates

    Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

    Loading the secure signup form…