Entra External ID - How to enable Microsoft Authenticator as default for MFA instead of Email OTP

Hello

Thanks for your question.

If you want to enforce MFA app usage you can leverage, Authentication policies here:

How To: Configure the multifactor authentication registration policy

Emergency access or break-glass accounts to prevent tenant-wide account lockout.

Service accounts and service principals, such as the Microsoft Entra Connect Sync Account.

Note that: this is a feature of Identity Protection which requires a P2 license

You can also configure an MFA registration Campaign instead to force users to sign up for the app, if you have only P1. See: https://zcusa.951200.xyz/en-us/entra/identity/authentication/how-to-mfa-registration-campaign

Also see:

Common Conditional Access policy: Require MFA for all users

https://zcusa.951200.xyz/en-us/microsoft-365/business-premium/m365bp-turn-on-mfa?view=o365-worldwide&source=recommendations&tabs=condit

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola

Hi Abiola,

Unfortunately this doesn't work, the policy is already configured for "All users", however, Policy enforcement is Disabled. Everytime I try and Enable Policy enforcment the portal provides the error below.

Please note this is an External ID tenant. I don't think P1/P2 works, however, the MFA registration campaign also doesn't work.

Although under Protection > Authentication methods > Policies the Microsoft Authenticator is enabled, targeting All users it won't trigger. Only the Email OTP triggers and if I disable Email OTP then users can't login because it doesn't fall back to the other methods enabled (Microsoft Authenticator and Third-party software OAUTH tokens are enabled and targeting All users).

Kind regards,

Jonathon

Hi @Jonathon Aroutsidis

Sometimes the "unable to save Microsoft Entra ID multifactor authentication registration policy" error occurs due to cached data. The policy may appear as disabled in the portal, even though it is actually already enabled. You can validate this by logging in from a private browser session.

Another consideration is that you cannot activate the sign in risk policy more than once, using different log in credentials from different domains. So if you have done this, you need to log in with the original log in credentials to save the policy.

To use this feature, you need to be logged in as a Global Admin and have a P2 license (as called out by akinbade). Here are some additional troubleshooting steps to try if you still face the error:

• Add users to groups and add/exclude the groups from the policy
• Confirm valid Premium P2 License for use of Identity Protection
• Check that "Users can use the combined security information registration experience" is selected.
• Change the default language of the Azure Portal to English if it is not already set to English, or to another language if it is set to English.

If these steps do not work, it would probably be worthwhile to create a support ticket to further investigate your issue. I tried reproducing the issue in my tenant and could not.

If the information helped you, please Accept the answer. This will help us and improve searchability for others in the community who may be researching similar questions. Otherwise let me know if you still face this issue.