I manage our Microsoft tenant where our staff uses SMS for multi-factor authentication (MFA). Recently, we transitioned from the old per-user MFA settings to a new methods system. When I check a new user's account under Authentication Methods, it shows their mobile number with the note '(Ready for SMS sign-in).' However, when I look at their sign-in logs, it indicates 'single factor' in the Authentication requirement column. Am I missing something here? Does 'Ready for SMS sign-in' mean these new employees are receiving an SMS code for MFA? I appreciate any clarification on this!
1 Answer
The phrase 'Ready for SMS sign-in' often confuses people. It doesn’t necessarily mean SMS is being used for MFA; instead, it just indicates that the user's phone number is set up for a newer feature where they can get a text code instead of entering a password. If you're seeing 'single factor' in the logs, that means no MFA was triggered, and only the username and password were used for signing in. You might want to check a couple of things:
- Make sure you have a Conditional Access policy set up that requires MFA.
- If you're using the new Authentication Methods policy, ensure that the 'SMS' option is enabled for MFA, not just for that passwordless option.
So to clarify: 'Ready for SMS sign-in' doesn't mean MFA is currently in use, and 'single factor' means there's no MFA taking place. Once you have the correct Conditional Access policy, you should start seeing logs indicating multi-factor authentication.
Thanks for the info and quick reply! So just to confirm for setting up the Conditional Access policy: I would set Users to 'All', Target resources to 'All resources', and under Access controls > Grant, select 'Require Multifactor authentication'? Is that all I need to do?