We need to transition a group of users from SMS-based multifactor authentication to the Microsoft Authenticator app. I'd like to avoid handling each user manually and instead have Entra ID prompt them to register Authenticator during sign-in. What policies and settings should we configure, and what is the best way to retire SMS without creating a confusing experience?
3 Answers
Don’t assume SMS is the only method that needs a replacement. Voice authentication is also being retired, so consider passkeys or security keys as an additional option rather than switching everyone from SMS to Authenticator alone. A small pilot group and a Conditional Access policy can help you catch sign-in and user-experience issues before a wider rollout.
Use the Entra ID Authentication methods policy to enable Microsoft Authenticator, then configure the Registration campaign to target the users or groups you want to migrate. Set the campaign to Enabled and explicitly choose Authenticator if that is the method you want users to register. Roll it out in stages and monitor registration before disabling SMS for everyone.
Make sure you move away from the older, legacy MFA and authentication policy settings first. Manage the methods through the current Authentication methods policy, and then disable SMS only after users have a working replacement. It’s also worth checking the registration campaign before making changes, since Microsoft-managed settings may already be prompting some users to register another method, such as passkeys.
A pilot is especially useful if you rely on an external MFA provider. Even when Authenticator and passkeys are disabled, users may still see Authenticator first and have to select another option, which can be confusing. Test the sign-in flow with real users before expanding the policy.