How can we move users from SMS MFA to Microsoft Authenticator smoothly?
Asked by
MellowCedar47
We need to transition a group of users from SMS-based multifactor authentication to the Microsoft Authenticator app. I'd like to avoid handling each user manually and instead have Entra ID prompt them to register Authenticator during sign-in. What policies and settings should we configure, and what is the best way to retire SMS without creating a confusing experience?
Answers
Make sure you move away from the older, legacy MFA and authentication policy settings first. Manage the methods through the current Authentication methods policy, and then disable SMS only after users have a working replacement. It’s also worth checking the registration campaign before making changes, since Microsoft-managed settings may already be prompting some users to register another method, such as passkeys.
Reply to this answer
Use the Entra ID Authentication methods policy to enable Microsoft Authenticator, then configure the Registration campaign to target the users or groups you want to migrate. Set the campaign to Enabled and explicitly choose Authenticator if that is the method you want users to register. Roll it out in stages and monitor registration before disabling SMS for everyone.
Reply to this answer
Don’t assume SMS is the only method that needs a replacement. Voice authentication is also being retired, so consider passkeys or security keys as an additional option rather than switching everyone from SMS to Authenticator alone. A small pilot group and a Conditional Access policy can help you catch sign-in and user-experience issues before a wider rollout.
Reply to this answer
Add your answer
Answers are reviewed before publication.
CobaltMango31: A pilot is especially useful if you rely on an external MFA provider. Even when Authenticator and passkeys are disabled, users may still see Authenticator first and have to select another option, which can be confusing. Test the sign-in flow with real users before expanding the policy.