Our Microsoft 365 tenant is configured to recommend Microsoft Authenticator as the preferred method when users set up multifactor authentication (MFA).
During the initial MFA enrollment process, users will be presented with Microsoft Authenticator as the primary option. The first screen prompts the user to install the Microsoft Authenticator app on their mobile device and complete the setup process.
While passkeys are supported in our environment, users are not currently prompted to configure a passkey during MFA enrollment. Passkeys can still be configured manually at a later time if desired.
After installing the Microsoft Authenticator App on their device, they will need to scan the QR code from the setup prompt to complete the sync.
Authenticator App QR Code Setup
If the user chooses "Set up a different authentication app", Microsoft displays a QR code that must be scanned using a compatible authenticator application, such as Google Authenticator, Authy, Duo Mobile, or Microsoft Authenticator.
Scanning the QR code adds the Microsoft account to the authenticator application and enables the generation of rotating six-digit verification codes. After scanning the QR code, select Next and enter the current six-digit code from the authenticator application to complete multifactor authentication (MFA) enrollment.
Once enrollment is complete, the authenticator application will continue generating rotating six-digit codes. Users may be prompted to enter one of these codes when signing in to Microsoft services from a new device, browser, or other session requiring MFA verification.
Phone number authentication is temporarily available as an alternative during MFA enrollment. However, Microsoft has announced that effective February 1, 2027, SMS and voice call authentication will no longer be supported for multifactor authentication. After this date, users will be unable to register a phone number for MFA or use a phone number to complete an MFA challenge. Users should enroll in Microsoft Authenticator to ensure continued access to Microsoft services.
Additional MFA Methods
Users may choose to add additional authentication methods after completing the required Microsoft Authenticator setup. These methods are not prompted for during the initial enrollment campaign.
To view or manage additional authentication methods, users can visit the Microsoft Security Info portal:
https://mysignins.microsoft.com/security-info
This portal allows users to add or remove authentication methods, including passkeys, hardware security keys, authenticator applications, and other supported sign-in options.
Comments
0 comments
Article is closed for comments.