Disabling mandatory MS Authenticator app

Anonymous
2023-09-12T11:08:43+00:00

Good afternoon,

We have text and call authentication set up as multi factor authentication for our users.

This has worked very well up until recently, when Microsoft have started to force the option of the authenticator app on users, and made it unskippable despite our setup.

The option to skip is not present on the "improve your sign ins" screen.

Where is the setting to disable the forcing of the authenticator app for the user?

I have seen on other posts there are options to disable this. For example here: https://learn.microsoft.com/en-us/answers/questions/1338546/users-are-being-forced-to-use-microsoft-authentica

If, as in the screenshot in the "accepted answer" post we change the registration campaign status to disabled, does this remove the enforced app prompt?

At present it is currently set to "Microsoft managed".

We are fine with the app as an OPTION however it should not be mandatory as it does exclude people who do not have the latest phones, or indeed, any smart phone.

Chris

Microsoft 365 and Office | Subscription, account, billing | For business | Other

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

64 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2023-11-01T14:27:43+00:00

    So if you disable the enrollment and use of Microsofts authenticator you do need to make sure others are enabled which I mentioned. So at https://entra.microsoft.com/ go to Protection -> Authentication Methods -> Polices: Turn ON the ones you want to use for all users. So "SMS" is text codes (which is going away next year fyi). "Third-party software OATH tokens" is things like Google Authenticator. Click each one you want, click Enable, then click All Users and save.

    I personally am using Google Authenticator because it backs up my codes to Google and if my phone dies I can replace it and get all my codes back easily. And my phone is through work so what if I get let go and they keep my number? At least with Google I will be able to get back into all my accounts. SMS is a dying option.

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  2. Anonymous
    2023-11-02T06:35:53+00:00

    The question has been misread - we do not want to disable the thing entirely, just the forcing of it onto users!!!

    At present our users are not allowed to opt out from the app download. Previously the app was an option rather than mandatory.

    You can individually configure it here:

    https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Properties

    Go to Protection - Authentication Methods and you can oppt in/out of the following:

    FIDO2 security key No Microsoft AuthenticatorNo

    SMSNo

    Temporary Access PassNo

    Hardware OATH tokens (Preview)No

    Third-party software OATH tokensNo

    Voice callNo

    Email OTPYes

    Certificate-based authenticationNo

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Anonymous
    2023-11-03T04:00:42+00:00

    A lot of people are dealing with this same issue. You are right, it is ridiculous! I just spent the past 6 hours going through dozens of help articles.

    I finally found one that worked! The link is below. Basically, you have to TURN OFF SECURITY DEFAULTS. After you do that, all the other options that you've already changed will take effect. I set mine up so that each user can choose whatever 2FA method they want. Hope this helps!

    Link: Disable mandatory Microsoft Authenticator App - (Even though the title of the article says to enable it, it's the same steps).

    Was this answer helpful?

    10+ people found this answer helpful.
    0 comments
  4. Anonymous
    2023-11-07T21:10:40+00:00

    Step 4 doesn't work because there is no "Microsoft Authenticator app" option.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2023-11-07T21:38:46+00:00

    You first need to disable security defaults then in order to remove the requirement for MFA (specifically MS Authenticator App). Here are the steps:

    1. Go to the Microsoft Entra admin center (https://entra.microsoft.com/) and sign in.
    2. Under Microsoft Entra ID (Azure AD), select Go to Microsoft Entra ID.
    3. Select Properties, scroll down, and then select the Manage security defaults link.
    4. On the right side of the screen, in the Security defaults pane, DISABLE security defaults, by using the drop-down menu to select Disable. Then select Save.
    5. Approve all the necessary warnings. This will allow other MFA options through this link: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods

    Here's the link to the official help article. Microsoft tricks you by wording the article as the way to enable it, even though that's already the default. Just follow the same steps to disable.

    https://learn.microsoft.com/en-us/microsoft-365/business-premium/m365bp-turn-on-mfa?view=o365-worldwide&tabs=secdefaults

    Was this answer helpful?

    5 people found this answer helpful.
    0 comments