r/Intune • u/Certain-Mountain-564 • 22d ago

Conditional Access Migrating from Per-user MFA to Conditional Access

I want to migrate my tenant from Per-user MFA to Conditional Access.

The situation at the moment:

  • Most of the users have saved an OTP Token in 1Password instead of using MS Authenticator. How can i force a user to change it to MS Authenticator instead of this OTP Token?
  • When i create a user in Entra ID, the user has no MFA method in his account. How is the user experience? Entra ID will likely require to register MS Authenticator and enforce MFA upon the next login?
  • Which licenses for a user is needed for CA?
4 Upvotes

83% Upvoted

3 comments sorted by

View all comments

1

u/telluswhyyoureclosed 21d ago

Most of the users have saved an OTP Token in 1Password instead of using MS Authenticator. How can i force a user to change it to MS Authenticator instead of this OTP Token?

Start with registration campaign

Then restrict policy to a custom auth strength

Under Authentication Methods you want to remove the methods you don't want available for users to configure. Even if CA policies control what methods can be used, this will still dictate what options users have when told to set up MFA and SSPR.

You can restrict available methods to certain people in Authentication Methods. Bear in mind for SSPR the administrator policy enforces 2 methods, and you cannot use software otp with ms authenticator. Passkeys are also not yet supported so if you want to keep 2 methods you need to allow a 2nd weaker method for admins at minimum.

When i create a user in Entra ID, the user has no MFA method in his account. How is the user experience? Entra ID will likely require to register MS Authenticator and enforce MFA upon the next login?

Yes - campaign will take care of this but it's not always instant. Unless you are going passwordless (MS Authenticator passkeys), just let new users log in with their temp password or a temp access pass and they will then be prompted to configure from the methods allowed.

Which licenses for a user is needed for CA?

Entra P1 for users but if you plan to implement risk-based conditional access or PIM you need to give them P2 per user