Disabling mandatory MS Authenticator app

Anonymous
2023-09-12T11:08:43+00:00

Good afternoon,

We have text and call authentication set up as multi factor authentication for our users.

This has worked very well up until recently, when Microsoft have started to force the option of the authenticator app on users, and made it unskippable despite our setup.

The option to skip is not present on the "improve your sign ins" screen.

Where is the setting to disable the forcing of the authenticator app for the user?

I have seen on other posts there are options to disable this. For example here: https://learn.microsoft.com/en-us/answers/questions/1338546/users-are-being-forced-to-use-microsoft-authentica

If, as in the screenshot in the "accepted answer" post we change the registration campaign status to disabled, does this remove the enforced app prompt?

At present it is currently set to "Microsoft managed".

We are fine with the app as an OPTION however it should not be mandatory as it does exclude people who do not have the latest phones, or indeed, any smart phone.

Chris

Microsoft 365 and Office | Subscription, account, billing | For business | Other

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

64 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2023-11-07T21:10:40+00:00

    Step 4 doesn't work because there is no "Microsoft Authenticator app" option.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2023-11-03T04:00:42+00:00

    A lot of people are dealing with this same issue. You are right, it is ridiculous! I just spent the past 6 hours going through dozens of help articles.

    I finally found one that worked! The link is below. Basically, you have to TURN OFF SECURITY DEFAULTS. After you do that, all the other options that you've already changed will take effect. I set mine up so that each user can choose whatever 2FA method they want. Hope this helps!

    Link: Disable mandatory Microsoft Authenticator App - (Even though the title of the article says to enable it, it's the same steps).

    Was this answer helpful?

    10+ people found this answer helpful.
    0 comments
  3. Anonymous
    2023-11-02T06:35:53+00:00

    The question has been misread - we do not want to disable the thing entirely, just the forcing of it onto users!!!

    At present our users are not allowed to opt out from the app download. Previously the app was an option rather than mandatory.

    You can individually configure it here:

    https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Properties

    Go to Protection - Authentication Methods and you can oppt in/out of the following:

    FIDO2 security key No Microsoft AuthenticatorNo

    SMSNo

    Temporary Access PassNo

    Hardware OATH tokens (Preview)No

    Third-party software OATH tokensNo

    Voice callNo

    Email OTPYes

    Certificate-based authenticationNo

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  4. Anonymous
    2023-11-01T14:27:43+00:00

    So if you disable the enrollment and use of Microsofts authenticator you do need to make sure others are enabled which I mentioned. So at https://entra.microsoft.com/ go to Protection -> Authentication Methods -> Polices: Turn ON the ones you want to use for all users. So "SMS" is text codes (which is going away next year fyi). "Third-party software OATH tokens" is things like Google Authenticator. Click each one you want, click Enable, then click All Users and save.

    I personally am using Google Authenticator because it backs up my codes to Google and if my phone dies I can replace it and get all my codes back easily. And my phone is through work so what if I get let go and they keep my number? At least with Google I will be able to get back into all my accounts. SMS is a dying option.

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  5. Anonymous
    2023-11-01T02:15:58+00:00

    I have disabled Microsoft Authenticator in all three places and it still requires our users to download the app - cannot bypass whatsoever and despite it being more than three hours, still same situation. I have put in a ticket to Microsoft support, but this is extremely aggravating. We have an attorney (user) that is completely locked out of her email account! This is ridiculous!!! We received no email regarding this from Microsoft that it was going to enforce this in the fall! ****!

    Was this answer helpful?

    30+ people found this answer helpful.
    0 comments