Disabling mandatory MS Authenticator app

The Authenticator Application has been a total disaster for me. I COUND NOT ACCESS MY OFFICE 365 ACCOUNT UNTIL I INSTALLED THIS APP. I still cannot use any Office 365 application from one of my laptops. It is completely locked out. This is a machine that I have used with Office 365 for years. It is now useless. I am talking to my attorney and will ask them to compose a complaint to the BBB (one of many, many complaints on the way). You cannot block access to an account that you are paying for and use every day in your business. This day was a total disaster.

I, unfortunately have two Office 365 accounts. I really don't have time to deal with a total loss of software and Office 365 accounts that go down due to this nonsense. It's enough that I cannot email clients with gmail accounts from Office 365 account. Do we really need to pile this disaster on top?

Not being able to tell the difference between a malware attack and an update is a major problem. What in God's name is Microsoft thinking?

It's more then just this it seems. Why they are forcing their second rate authenticator is beyond me but it's annoying. In Entra (old Azure) at https://entra.microsoft.com/ :

Protection -> Authentication Methods -> Settings -> System-preferred multifactor authentication: Disabled

Protection -> Authentication Methods -> Registration Campaign: Edit then Disabled and Save

Protection -> Authentication Methods -> Policies: Click Microsoft Authenticator and switch it to Disabled (if you want) then go to the others you do want and make sure they are enabled for all users (or whatever users you want). We have SMS, Voice Call, and Email OTP personally.

Yeah....these responses are about enabling or disabling ms auth as a whole, or per user, not the "hey user, we noticed this auth flow doesn't use ms authenticator, download it here." While this is needed capability in some rollout using soft launches, these aren't the settings to control that policy.

I found what looks like the policy for ms forcing download setting @

a) Entra ID > Security > Authentication Methods > settings

b) configure the two areas to your liking, enabled with group based targeting and/or exclusions if you want to...disabled if you want an out of band method, disabled if you want 3rd party mfa.

Saw this post when googling the config to solve it for my use case...haven't tested yet.

Clearly, Microsoft STILL doesn't understand your very simple question. The way I read this response is that they don't want to admit it's all or nothing. Either disable the authenticator or it will be required by Microsoft (probably due to someone's Draconian view of security... thanks, dude).

It Seems that its very hard for Microsoft to understand the question at hand.

Let me simplify.

1: The Administrator DOES want to enforce MFA

BUT does not want to enforce Microsoft Authenticator.

Having MFA is important, but Microsoft deciding that all users should use Microsoft Auth as the standard is not correct.

Extra: how to exclude specific users from MFA in Microsoft 365?

What I was able to find: How to migrate to the Authentication methods policy - Microsoft Entra | Microsoft Learn

I was able to "uncheck" the Notification through mobile app and the Verification code from mobile app or hardware token. Hopefully this works.

Note: this is for ALL Users (not specific).