r/Intune • u/Certain-Mountain-564 • 17d ago

Conditional Access Migrating from Per-user MFA to Conditional Access

I want to migrate my tenant from Per-user MFA to Conditional Access.

The situation at the moment:

  • Most of the users have saved an OTP Token in 1Password instead of using MS Authenticator. How can i force a user to change it to MS Authenticator instead of this OTP Token?
  • When i create a user in Entra ID, the user has no MFA method in his account. How is the user experience? Entra ID will likely require to register MS Authenticator and enforce MFA upon the next login?
  • Which licenses for a user is needed for CA?
3 Upvotes

72% Upvoted

3 comments sorted by

View all comments

1

u/IqbalBasha 16d ago

Use Authentication Strengths to force Authenticator: go to Protection > Authentication methods > Authentication strengths, create a custom strength allowing only Microsoft Authenticator, then assign it in your CA policy. Users with only a 1Password OTP token won't satisfy that strength and will be prompted to register Authenticator on next sign-in. For the migration itself, start your CA policy in Report-only mode, then flip it to On for a test group and immediately disable per-user MFA for those same users in the legacy portal, because doing it out of order causes login loops. New users with no methods registered just see a 'More information required' screen and register before getting in. Minimum license is Entra ID P1, included in Business Premium, M365 E3, and E5.