Switching users from SMS to Authenticator and disabling SMS?

[u/elitesparten117]

Hello folks,

We’ve been tasked to switch some of our users from SMS to the MS Authenticator app. Rather than doing this manually, I’d like to make this seamless as possible. I think creating a policy in entra ID where it’ll prompt our end users to enroll into MS Authenticator ? Curious to know how others have tackled this.

[u/blud_13]

Check your Registration campaign setting before you build anything, it may already be doing something you didn't ask for.

u/VapouryString is right about moving off the legacy MFA settings into the Authentication methods policy, do that part first. The piece you need to watch out for is what happened on September 1. Users who were enabled for SMS or voice got auto enabled for passkeys, and the Registration campaign got flipped to Microsoft managed targeting PASSKEYS. So your SMS users are getting nudged right now, just not toward Authenticator.

Microsoft managed locks the target method, the snooze duration and the snooze count, you cannot tweak any of it. If you want Authenticator specifically you have to set the campaign state to Enabled and pick Authenticator yourself. Its documented here https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement

Worth deciding whether you even want to fight it. If passkeys are on the table anyway, letting the Microsoft managed campaign run is less work than what you were about to build.

[u/elitesparten117 → u/blud_13]

Thanks for that! It really does look like it would be the easier route. Do you know if I can scope it down to a few test users?

[u/blud_13 → u/elitesparten117]

Yes, and you don't have to leave Microsoft managed to do it. Include and exclude targets stay configurable in either state, its only the method, the snooze duration and the snooze count that get locked when Microsoft manages it. Its in the state description at https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-registration-campaign

For a proper pilot set state to Enabled, put the test group in includeTargets with targetedAuthenticationMethod microsoftAuthenticator, and leave excludeTargets empty. Exclude wins if somebody lands in both.

Be careful though, the campaign runs ONE method tenant wide. You cannot nudge your pilot group toward Authenticator while passkeys keep running for everyone else. The moment you flip it to Enabled for the test group, the Microsoft managed passkey nudge stops for the whole tenant and everybody outside that group gets nothing.

Snooze duration is tenant wide too, so the pilot cannot have a tighter loop than the rest of production.

One other thing to check... Authenticator campaigns don't fire on mobile at all, so run your test from a desktop browser or you will think its broken.

[u/raip → u/elitesparten117]

Not if you're using the Microsoft Managed feature. Swap it to enabled to target (or exclude) a group.

[u/ShadowCVL → u/blud_13]

This really makes duo a pain for me.

The custom control is retiring so I started up a new CAP for the external authentication, piloting it with a few users before we go wide with it, but the first login after getting flipped over even with Authenticator turned off and passkeys turned off it’s still surfacing Authenticator as an option, I have to make users click the blue text to use something else then click duo. It simple but a pain for users who don’t want to read.

It’s actually causing us to debate continuing with duo and possibly moving just to ms Authenticator and passkeys.

As an admin I have Authenticator, duo, passkeys, and 2 yubikeys and generally just use Authenticator as passkey takes longer than password and acknowledging duo.

[u/Thin-Book]

If you haven't already, check Authentication Methods and Registration Campaign in Entra instead of forcing it through one policy. I wouldn't kill SMS on day one unless you know every account has another working method enrolled, or you'll create a helpdesk queue fast.

[u/VapouryString]

Oh and don't forget to disable legacy Authentication Policies and transition everything to Entra.

[u/raip → u/VapouryString]

This deadline for this was a year ago...

[u/SASardonic]

If you're any reasonably sized organization get ready for an ass load of change management for this from stragglers. This was not fun to have to deal with in Okta.

[u/VapouryString]

Yes! Authentication Policy in Entra to Enable Microsoft Authenticator and Voice call as secondary Method.

[u/ShadowCVL → u/VapouryString]

Voice call is retiring as well same date as SMS. Recommend passkeys as secondary before that date

[u/bobsmith1010]

While prompting users are probably fine, I would also do some give away campaigns. You still need a user to setup the authenticator and if they don't you'll end up with a ton of users who haven't signed up and then when you go to disable SMS you'll get tickets where people can't sign in.

[u/FireLucid → u/bobsmith1010]

We have two left. One is philosophically opposed to using QR codes to set up authenticator.🤷‍♂️

[u/kernelqzor → u/bobsmith1010]

this is super true, the human factor is the killer here
i've seen places do like “set up authenticator by X date and get a gift card / swag” and the adoption rate shot way up compared to nag emails and hard cutoffs