We used Duo to send a verification prompt or check a code when someone called IT. We now use Microsoft Authenticator and would like to stop paying for Duo, but we still need a reliable way to handle callers requesting help.
For example, someone with a stolen laptop could see the last username and call asking for a password reset. Is there a comparable Microsoft workflow, or a better way to handle this?
For password resets, start with Microsoft Entra self-service password reset rather than having the help desk reset passwords after a phone conversation. Configure the required verification methods and, where supported in your environment, make the reset option available from the sign-in screen.
That doesn't solve every support request. Keep a separate, documented identity verification and escalation process for people who can't use their registered methods, including cases where a device or account may be compromised.
There are scripts that trigger Microsoft MFA notifications using an endpoint associated with the NPS MFA extension. That gets closer to the push workflow, but the specific on-demand help desk use isn't supported and relies on functionality that isn't well documented. I'd be cautious about making it a critical process.
Also, a successful prompt establishes control of a registered factor, not the caller's identity with certainty. An attacker could relay a challenge or pressure the real user to approve it. Decide what the prompt actually authorizes and how staff handle an unexpected or failed response.
Be careful with the idea of asking callers to read out the six-digit code in Authenticator. Support would need a way to verify the code, and teaching people to give authentication codes to someone on the phone can make phishing easier.
A separate TOTP verification system is possible, but its shared secrets would need careful protection. I wouldn't assume the existing Microsoft sign-in code gives the help desk a ready-made verification service.
For requests beyond password resets, consider calling the person back using a number already recorded in a trusted directory, not a number supplied during the call. Have a separate escalation path when that number is unavailable or might be compromised.
For sensitive requests such as releasing customer data, verify the request and the person's authority to receive it too. Proving control of an authentication factor doesn't automatically approve the action.
Entra Verified ID is another option worth evaluating if you need a dedicated credential verification flow. It takes setup and would be a different process from sending an Authenticator push, so check whether it fits your support workflow before retiring the existing service.
Answers are reviewed before publication.
longform-but-brief:
That would cover the password example, but we also need to verify requests that aren't about passwords.