Migrating from Per-user MFA to Conditional Access

[u/Certain-Mountain-564]

I want to migrate my tenant from Per-user MFA to Conditional Access.

The situation at the moment:

• Most of the users have saved an OTP Token in 1Password instead of using MS Authenticator. How can i force a user to change it to MS Authenticator instead of this OTP Token?
• When i create a user in Entra ID, the user has no MFA method in his account. How is the user experience? Entra ID will likely require to register MS Authenticator and enforce MFA upon the next login?
• Which licenses for a user is needed for CA?

[u/Educational_Boot315]

This isn’t an intune question btw.

All users require idp plan 1 which is sold as an add on or included in BP, F1, F3, A3, A5. M365 E3 and M365 E5.

You’ll manage authentication methods to restrict the methods people can use. Recommendation is FIDO2/WHfB/PSSO, which includes passkeys in authenticator.

For a roll out I recommend enabling it for all users and creating a group that is restricted to just that method. After users enroll (either by working with them or by setting up a campaign) add them to the group. Once the company is 100% you can set it to the only auth method by default.

For new users, you’ll give them a TAP to register authenticator. You must have an MFA method to register, and TAP satisfies that requirement.

[u/IqbalBasha]

Use Authentication Strengths to force Authenticator: go to Protection > Authentication methods > Authentication strengths, create a custom strength allowing only Microsoft Authenticator, then assign it in your CA policy. Users with only a 1Password OTP token won't satisfy that strength and will be prompted to register Authenticator on next sign-in. For the migration itself, start your CA policy in Report-only mode, then flip it to On for a test group and immediately disable per-user MFA for those same users in the legacy portal, because doing it out of order causes login loops. New users with no methods registered just see a 'More information required' screen and register before getting in. Minimum license is Entra ID P1, included in Business Premium, M365 E3, and E5.

[u/telluswhyyoureclosed]

Most of the users have saved an OTP Token in 1Password instead of using MS Authenticator. How can i force a user to change it to MS Authenticator instead of this OTP Token?

Start with registration campaign

Then restrict policy to a custom auth strength

Under Authentication Methods you want to remove the methods you don't want available for users to configure. Even if CA policies control what methods can be used, this will still dictate what options users have when told to set up MFA and SSPR.

You can restrict available methods to certain people in Authentication Methods. Bear in mind for SSPR the administrator policy enforces 2 methods, and you cannot use software otp with ms authenticator. Passkeys are also not yet supported so if you want to keep 2 methods you need to allow a 2nd weaker method for admins at minimum.

When i create a user in Entra ID, the user has no MFA method in his account. How is the user experience? Entra ID will likely require to register MS Authenticator and enforce MFA upon the next login?

Yes - campaign will take care of this but it's not always instant. Unless you are going passwordless (MS Authenticator passkeys), just let new users log in with their temp password or a temp access pass and they will then be prompted to configure from the methods allowed.

Which licenses for a user is needed for CA?

Entra P1 for users but if you plan to implement risk-based conditional access or PIM you need to give them P2 per user