You cannot set up paswordless phone sign-in because your IT admin has disabled this feature

Question

You cannot set up paswordless phone sign-in because your IT admin has disabled this feature

Calvin Goodman 86

I have followed this kb https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-phone to enable passwordless "phone" sign-in and it worked for me. When I tried to enable phone sign-in in my Authenticator app for couple test users' accounts but received the same error, "You cannot set up paswordless phone sign-in because your IT admin has disabled this feature,"

Everything seems to be configured properly and I know mine is working. Not sure why others did not work. Any suggestion is appreciated!

Thanks

Calvin

0 comments

Answer accepted by question author

Harpreet Singh Matharoo 8,431 Microsoft Employee Moderator

Hello @Calvin Goodman

Thank you for reaching out. I would like to inform you that to enable Passwordless phone sign-in for your test users, you need to make sure that the users are in scope for the deployment. The error you see "You cannot set up passwordless phone sign-in because your IT admin has disabled this feature", usually occurs when the user is not scope of the Passwordless policy setup on Azure AD portal.

The users must be included in the group of users enabled for passwordless sign-in. If the users are not in scope for passwordless authentication, they will not be able to register or complete the passwordless sign-in process.

You can check the Authentication methods policy in the Azure AD portal to see if the users are included in the group of users enabled for passwordless sign-in. If the users are not included, you can add them to the group. Below is the screenshot for your reference:
User's image

You can also check if the users have the latest version of Microsoft Authenticator installed on their devices and if the devices are registered with the tenant where they are used to sign in.

I hope this answer helps to resolve your issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Calvin Goodman 86 Reputation points

2023-03-09T14:50:12.6266667+00:00

Hi Harpreet,

Thanks for pointing out it's the scope related. I removed the 365 group and added a Security group instead, then it worked for the test users.
Yev Kovalerchik 45 Reputation points

2023-03-10T19:11:03.7433333+00:00

Please include Calvin's comment in your answer. The authenticator settings using Microsoft 365 groups don't work for passwordless authentication and switching to a standard security group works (not using a group based security group)
Chabs 0 Reputation points

2023-04-03T11:46:38.3633333+00:00

Wrong. Although for some reason AAD is showing the Authentication Methods are all greyed out including for Authenticator, I can see all users are already in scope yet they still get the error this thread is titled with.

1 additional answer

Your answer

Calvin Goodman 86 Reputation points

2023-03-09T14:50:12.6266667+00:00

Hi Harpreet,

Thanks for pointing out it's the scope related. I removed the 365 group and added a Security group instead, then it worked for the test users.
Yev Kovalerchik 45 Reputation points

2023-03-10T19:11:03.7433333+00:00

Please include Calvin's comment in your answer. The authenticator settings using Microsoft 365 groups don't work for passwordless authentication and switching to a standard security group works (not using a group based security group)
Chabs 0 Reputation points

2023-04-03T11:46:38.3633333+00:00

Wrong. Although for some reason AAD is showing the Authentication Methods are all greyed out including for Authenticator, I can see all users are already in scope yet they still get the error this thread is titled with.

Answer 1

Yev Kovalerchik 45

Use an azure security group for the Microsoft authenticator security methods policy

Microsoft 365 groups don't work with passwordless sign-in

Nguyen Quang Huy-Cyber Security Team Leader 0 Reputation points

2023-03-15T11:02:00.0666667+00:00

Thanks you! I can register phone sign-in when a change group to Security Group
Reuben MPH Harrison 0 Reputation points

2026-07-18T17:14:49.1+00:00

What if the M365 group was set to be security enabled via PowerShell?