Which communication channels and features can CPaaS add to an application?

A CPaaS, short for communications platform as a service, gives an application programmatic access to communication channels that would otherwise require carrier relationships, telephony equipment, and regulatory registrations of your own. Microsoft publishes a full capability list for Azure Communication Services covering identity, chat, email, SMS, WhatsApp messaging, voice and video calling, PSTN phone calling, call automation, Microsoft Teams interoperability, job routing, and AI features [1]. Vendor vocabulary differs, but the underlying set is fairly stable across the category.

The channel is only half of what you buy

Sending a text message is one API call. Getting that message delivered to a US mobile subscriber requires a registered brand, a registered campaign, and a phone number tied to both, because US carriers filter application traffic sent over 10-digit long codes that nobody has registered [2]. The pattern repeats on every channel: email needs SPF, DKIM, and a DMARC record before a mailbox provider will accept volume from a new domain [9][10], and WhatsApp needs approved templates before your code can start a conversation [4].

Two shapes of integration

Most implementations fall into one of two shapes. Notification traffic is one-directional, where an event in your system triggers a message and the recipient rarely replies, which is the easiest thing to build and the easiest to get filtered if consent handling is weak. Interactive traffic is two-way and stateful, where inbound messages and calls arrive at a webhook you host and your application has to know which conversation they belong to. The second shape is where the platform's extras start to matter, since session state, routing, and transcription are the parts you would otherwise write yourself [1][7]. The category has also moved quickly, adding verification that avoids passcodes entirely [11] and WebSocket plumbing that streams live call audio to a language model [6].

SMS and MMS reach almost any mobile handset without asking the recipient to install anything, which is why order updates, appointment reminders, and delivery notifications still run on them. Azure Communication Services describes its SMS capability as sending and receiving text messages through SMS SDKs [1], and every serious platform exposes the same two directions: outbound sends from your code, and inbound messages posted to a webhook you host.

The operational work sits in the number and the registration behind it. In the United States, any application sending SMS or MMS over a 10-digit long code has to register under A2P 10DLC, which Twilio describes as the standard US carriers put in place so that traffic to US end users through long code numbers is verified and consensual [2]. A brand record tells carriers who is sending, and a campaign record describes the purpose of the messages plus how recipients opt in, opt out, and get help [2].

Skipping registration is not a neutral choice, because senders on an unregistered 10DLC number pay additional carrier fees while registered senders see lower filtering and higher throughput [2]. Throughput then varies by campaign type: a Low-Volume Mixed campaign is capped at fewer than 2,000 message segments per day on T-Mobile in exchange for a lower monthly fee [2].

If a long code does not fit your volume, toll-free numbers and short codes sit outside the A2P 10DLC system and follow their own vetting paths [2]. Decide the number type early, because switching mid-project restarts the approval clock.

RCS and WhatsApp turn a text thread into something closer to an app screen, with branding, structured buttons, and feedback about whether the message landed. Twilio's RCS documentation lists message features including suggested replies, call-to-action buttons, dynamic carousels, and location sharing, along with delivery and read receipts [3]. RCS also replaces the anonymous sending number with a branded sender profile, and Twilio records compatibility with Android and iOS 18 devices [3], which is the change that moved RCS from an Android-only experiment into something worth building for.

WhatsApp behaves differently, because the platform rather than the carrier sets the rules. Microsoft's documentation for Advanced Messaging distinguishes business-initiated from customer-initiated conversations and requires templates to start a conversation with a user [4]. That template requirement is the main design constraint on the channel, since your application cannot improvise an outbound message.

One change is worth designing around right now. WhatsApp is introducing usernames during 2026, and Meta has added a business-scoped user ID so a person can be addressed without exposing a phone number, with those identifiers supported as recipients in send requests from June 2026 [4]. Microsoft flags this as a breaking change: the from and to fields in messaging events may arrive empty when a user hides their number, so handlers need to read the new BSUID fields instead [4].

Voice through a CPaaS covers both the call and the logic wrapped around it. Azure Communication Services separates the two explicitly: phone calling adds telephony and PSTN access to an application, while call automation builds customer interaction call workflows and call recording for voice and PSTN channels [1]. Twilio's Programmable Voice documentation describes making and receiving calls from your application, responding to incoming calls, gathering user input from the keypad, recording calls, and converting live or recorded audio into searchable text [5].

Teams tend to use this for a few distinct jobs. Automated outbound calls carry notifications where a text message is not enough, such as a service outage or a same-day cancellation. Inbound call handling replaces a hosted IVR with logic in your own codebase, so routing decisions read from your database rather than from a menu tree someone configured in a portal months ago. Recording and transcription then feed quality review and the call summaries written back to a CRM record [5][7].

The number itself is as much a product decision as a technical one, because a local number, a toll-free number, and a number carrying a verified caller name differ in whether the call gets answered at all. That is why phone number intelligence tends to sit beside the voice APIs rather than inside them [12].

Embedded calling puts the conversation inside your product rather than on the phone network, using the browser and mobile real-time stack instead of a carrier. Azure Communication Services describes voice and video calling as embedding calls into websites and native applications, and chat as real-time text communication across a cross-platform application [1]. Underneath sits WebRTC, described in RFC 8825 as a protocol suite intended for real-time applications that can be deployed in browsers [8].

What you get beyond the raw media stream is the part worth comparing between vendors. Microsoft documents client-side background blur and replacement, real-time closed captions optimized for accessibility, and a machine learning model in the calling SDK that improves audio through echo cancellation and noise suppression, toggled on and off from the client [7]. Access to the raw audio and video feed is also exposed, which is what makes custom processing such as computer vision on a live feed possible [7].

In-app chat is the quieter half of this pairing and often the more useful one. A persistent thread that belongs to your application, rather than to a messaging network, keeps history, participants, and attachments inside your own compliance boundary, and it connects to bot frameworks directly, since Microsoft's chat system integrates with Azure Bot Service so an automated participant can join a human conversation [7].

Email in a CPaaS is aimed at application-generated mail rather than at inboxes people type into. Azure Communication Services supports high-volume transactional, bulk, and marketing email for application-to-person use cases, available through SDKs and through SMTP commands [9]. Named features include custom domain sending, SPF and DKIM sender authentication, delivery status in near real time, opt-out handling through a suppression list, and engagement tracking that covers bounce, blocked, open, and click events [9].

Deliverability is where email differs most from the other channels, because the receiving mailbox provider sets the bar and your vendor cannot raise it for you. Google requires that senders of more than 5,000 messages per day to Gmail accounts set up SPF and DKIM for the sending domain, publish a DMARC record even at an enforcement policy of none, maintain valid forward and reverse DNS records, and align the domain in the From header with either the SPF domain or the DKIM domain [10]. Marketing and subscribed messages must also support one-click unsubscribe using the List-Unsubscribe-Post header [10].

Spam rates reported in Postmaster Tools should stay below 0.30 percent, with 0.10 percent given as the level that keeps a sender resilient [10]. Those requirements are configuration rather than code, and they are usually what delays an email launch, so reserve time for DNS changes and for the warm-up a new sending domain needs.

Verification APIs replace the code you would otherwise write to generate, deliver, expire, and rate-limit one-time passcodes, and the newer methods skip passcodes altogether. Twilio's Verify documentation lists verification through SMS, passkeys, silent network authentication, voice, WhatsApp, TOTP, push, silent device approval, and email [11]. The passwordless options matter because SMS-delivered passcodes carry per-message cost and fraud exposure, and every code a user has to read and retype is a step where signups are abandoned.

Silent network authentication is worth understanding in detail, because it works with no user input at all. The CAMARA project, the open-source home of the network APIs carriers expose through GSMA Open Gateway, defines a Number Verification API that confirms ownership of a mobile phone number and retrieves the number directly from the user's device, relying on the operator's knowledge of which subscriber a connected handset belongs to and on identification of the SIM [13]. Because the check happens in the network, it removes the manual SMS code step from account creation, login, and transaction validation [13].

Phone number intelligence sits alongside verification and answers questions about a number before you spend money sending to it. Twilio's Lookup packages include line type intelligence for filtering invalid and landline numbers ahead of a send, reassigned number checks aimed at Telephone Consumer Protection Act exposure, identity match, caller name, SIM swap detection, call forwarding status, an SMS pumping risk score, and line status [12].

AI features in a CPaaS are mostly plumbing that connects a live conversation to a model, plus a few transformations applied to the media itself. Microsoft splits them into direct integrations, where the platform is already wired to an AI service, and accessors, which hand you raw or transformed communication data to send wherever you like [7]. Under the first heading are speech synthesis and speech recognition APIs used to build voice bots, sometimes called IVR [7]. Under the second are service-to-service WebSocket APIs that stream audio in both directions, so an application can listen to a call and speak into it, plus real-time transcription and call recording written to your own datastore [7].

Twilio's equivalent shows how thin the application layer has become. ConversationRelay handles the speech-to-text and text-to-speech conversion, session management, and low-latency communication, then connects to your AI application over a WebSocket so your code deals only with conversational logic [6]. It also exposes interruption controls, including whether caller speech or keypad input may interrupt playback and how sensitive that interruption should be [6].

Building a voice agent is therefore closer to writing a WebSocket handler than to running a telephony project. What remains genuinely hard is the latency budget and the design of what happens when the model gets something wrong, since a caller cannot scroll back and reread the last turn.

Registration and vetting set your real launch date

Brand and campaign registration is a prerequisite for US long code SMS, and unregistered traffic attracts extra carrier fees and heavier filtering [2]. Toll-free numbers and short codes avoid A2P 10DLC but carry their own vetting [2]. Treat all of it as a dependency with a lead time rather than as a form somebody fills in during launch week.

Consent handling is a system requirement

Under 47 CFR 64.1200(a)(10), a revocation request must be honored within a reasonable time not to exceed ten business days from receipt, and a text reply of stop, quit, end, revoke, opt out, cancel, or unsubscribe all count as reasonable methods [14]. The FCC has separately extended, until January 31, 2027, the waiver of the requirement that a revocation sent in response to one type of informational message applies to all future robocalls and robotexts from that caller on unrelated matters [15]. The core rule is in force today, so the open question is how far an opt-out must propagate across unrelated message types.

The channel owner writes the rules, not your vendor

WhatsApp requires approved templates for business-initiated conversations [4], RCS behavior depends on device support [3], and mailbox providers set deliverability thresholds independent of whoever sends your mail [10]. A CPaaS gives you access to each channel, but permission to send stays with whoever owns it.

Identifiers are shifting under existing data models

WhatsApp usernames and business-scoped user IDs arrive during 2026, and Microsoft warns that the from and to fields in messaging events may be empty when a user hides a phone number [4]. Any schema that treats a phone number as the customer key will need revisiting.

Portability varies a lot by channel

Changing SMS providers is mostly number porting plus re-registering campaigns. Replacing an embedded video stack means swapping client SDKs in every application you ship [8], and replacing a voice AI integration means rebuilding the WebSocket contract between the platform and your model [6].

It is not a phone system for employees

A CPaaS gives software an API, while a UCaaS product gives staff desk phones, voicemail, presence, and meetings. The two categories connect rather than overlap, which is why Azure Communication Services lists Microsoft Teams interoperability as its own separate capability [1].

It is not a contact center

Agent desktops, workforce management, and supervisor tooling belong to CCaaS. Some platforms sell a routing component, such as the job router that manages and optimizes customer interactions between different communication applications [1], which is a building block for a contact center rather than a substitute for one.

It is not a way around messaging rules

Sending through an API does not move responsibility for consent onto the platform, because registration, opt-out handling, and the ten business day revocation window all apply to the sender [2][14].

It is not free of telephony concepts

Numbers, carriers, filtering, and caller identity still exist and still decide whether a message or a call arrives [2][12]. The API hides the signaling, not the network.