Migration Status for Authentication Method- marking it as complete

Hello @Abrar Adil S

Greetings!

Based on the information you've shared, marking the migration status as Complete should not interrupt users who are already using Microsoft Authenticator for MFA, provided that Microsoft Authenticator remains enabled in the Authentication Methods Policy.

A few points that may help:

1. Existing Microsoft Authenticator registrations are retained. The migration process only changes where authentication methods are managed. It does not remove or recreate users' existing Microsoft Authenticator registrations. Microsoft documentation notes that the migration moves tenant policy settings, while individual user authentication method registrations remain unchanged.
2. MFA and SSPR should continue to function normally as long as the required authentication methods are enabled in the Authentication Methods Policy. Microsoft states that methods enabled in the Authentication Methods Policy can generally be used for both authentication and password reset scenarios, subject to the capabilities of the specific method.
3. Before selecting Complete, verify that:
   • Microsoft Authenticator is enabled for all intended users or groups in the Authentication Methods Policy.
     • Any users who need Self-Service Password Reset have at least the required authentication methods available based on your SSPR configuration.
       • You have reviewed any Conditional Access policies or Authentication Strength requirements that depend on specific authentication methods.

According to Microsoft Learn, once migration is completed, the legacy MFA and SSPR authentication method settings no longer apply, and management is performed through the Authentication Methods Policy. Microsoft also states that users can continue to sign in and reset their passwords using the same methods that were previously configured when the corresponding methods remain enabled in the new policy.

References:

• https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-methods-manage
• https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage

Therefore, in your scenario, where only Microsoft Authenticator is enabled and users are already using it successfully for MFA, marking the migration as Complete is generally expected to be a management change rather than a user-facing change, provided the Authentication Methods Policy is configured correctly for the affected users.Based on the information you've shared, marking the migration status as Complete should not interrupt users who are already using Microsoft Authenticator for MFA, provided that Microsoft Authenticator remains enabled in the Authentication Methods Policy.

A few points that may help:

1. Existing Microsoft Authenticator registrations are retained. The migration process only changes where authentication methods are managed. It does not remove or recreate users' existing Microsoft Authenticator registrations. Microsoft documentation notes that the migration moves tenant policy settings, while individual user authentication method registrations remain unchanged.
2. MFA and SSPR should continue to function normally as long as the required authentication methods are enabled in the Authentication Methods Policy. Microsoft states that methods enabled in the Authentication Methods Policy can generally be used for both authentication and password reset scenarios, subject to the capabilities of the specific method.
3. Before selecting Complete, verify that:
   • Microsoft Authenticator is enabled for all intended users or groups in the Authentication Methods Policy.
     • Any users who need Self-Service Password Reset have at least the required authentication methods available based on your SSPR configuration.
       • You have reviewed any Conditional Access policies or Authentication Strength requirements that depend on specific authentication methods.

According to Microsoft Learn, once migration is completed, the legacy MFA and SSPR authentication method settings no longer apply, and management is performed through the Authentication Methods Policy. Microsoft also states that users can continue to sign in and reset their passwords using the same methods that were previously configured when the corresponding methods remain enabled in the new policy.

• https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-methods-manage
• https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage

Therefore, in your scenario, where only Microsoft Authenticator is enabled and users are already using it successfully for MFA, marking the migration as Complete is generally expected to be a management change rather than a user-facing change, provided the Authentication Methods Policy is configured correctly for the affected users.

Please let me know if you have any other concerns.

Regards,

Saravana.