“Entra External ID CIAM: Can we use third‑party SMS providers (Twilio/Infobip) for MFA OTP instead of Microsoft SMS?”

1. Microsoft Entra External ID (CIAM) does not support replacing the built‑in SMS MFA delivery with a third‑party SMS provider. In external tenants, SMS is described as a Microsoft‑managed, add‑on second‑factor method that includes built‑in fraud checks (CAPTCHA, throttling, regional restrictions, phone number reputation) and safeguards against telephony fraud. There is no documented mechanism to intercept or override the SMS send/verify flow with a custom SMS provider in the MFA pipeline, unlike the flexibility available for email OTP. SMS MFA is explicitly positioned as a platform feature:
   • It is only available as a second factor.
   • It is tied to a linked Azure subscription and Microsoft’s own telephony and fraud‑protection stack.
   • Fraud controls (including phone number reputation and regional protections) are part of the Microsoft‑managed SMS flow and not exposed for replacement.
2. The officially recommended pattern for advanced SMS scenarios is not to bring your own SMS gateway, but to add third‑party fraud protection in front of Microsoft’s SMS MFA while still using Microsoft Entra External ID to issue and validate the OTP. The guidance for native applications using SMS‑based MFA is:
   • Use Microsoft Entra External ID’s SMS MFA as the OTP issuer/validator.
   • Integrate a third‑party fraud protection provider (for example, Human Security or Prove) into the native app.
   • Collect device, behavioral, and network signals via the provider’s SDK.
   • Call the provider before triggering SMS MFA and classify the risk of the sign‑in attempt.
   • Place a customer‑managed web application firewall (WAF) in front of Microsoft Entra External ID endpoints.
   • The WAF enforces the fraud decision:
     • Low/acceptable risk → forward the request so Entra External ID sends the SMS OTP.
     • High risk requiring extra verification → complete provider‑specific challenge before continuing.
     • High risk with failed evaluation → block the request; no SMS OTP is sent.
   In this architecture:
   • Microsoft Entra External ID continues to own SMS OTP delivery and verification.
   • The third‑party provider and WAF control whether a given request is allowed to reach Entra’s SMS endpoint.
   • This reduces exposure to IRSF and account takeover while preserving Microsoft’s built‑in protections and subscription‑based SMS model.
   For browser‑based External ID user flows (non‑native), SMS MFA is still Microsoft‑managed and includes automatic fraud checks and CAPTCHA when fraud is suspected. There is no documented pattern to offload SMS sending to Twilio/Infobip or Azure Communication Services while still using the built‑in MFA policy.
3. No roadmap or official guidance in the provided material indicates support for custom/bring‑your‑own SMS OTP providers in External ID MFA. The current guidance focuses on:
   • Using Microsoft Entra External ID’s own SMS MFA as the second factor.
   • Linking the external tenant to an Azure subscription to enable SMS as an add‑on feature.
   • Enhancing protection against IRSF and other telephony fraud by integrating third‑party fraud protection ahead of the SMS challenge, not by replacing the SMS transport.
   There is no mention of:
   • An event such as smsOtpSend.
   • A pluggable SMS provider model for MFA.
   • A roadmap commitment to support custom SMS OTP providers in External ID MFA.
   Any scenario that requires Twilio/Infobip to actually send the MFA OTP would therefore need to be implemented as an application‑managed authentication/MFA flow outside the built‑in External ID MFA feature, which is not covered in the referenced guidance. The documented, supported pattern is to keep Microsoft as the SMS OTP provider and add third‑party fraud/risk evaluation in front of it.

References:

• Secure SMS MFA in native authentication with third‑party fraud protection
• Multifactor authentication in external tenants
• Add multifactor authentication (MFA) to an app
• Microsoft Entra External ID frequently asked questions