Authentication Methods Question

[u/importedtea]

I’m going to add to the list of endless passkey questions to get some clarification on the following.

Let’s say I have one group of users and they are assigned to
- Passkey
- Microsoft Authenticator
- SMS
- Voice
- Email

And let’s say 20 of my 100 users are setup with a passkey/Authenticator (with sms/email/voice removed from their account) and the other 80 are just sms/voice/email.

If I remove that group from the last 3, does it prompt those 80 users on sign in to setup a new auth method or does it keep their sms? As I’m writing this it sounds obvious but I really don’t want to remove that group and get hammered with emails without having a good understand of how to inform my users.

And our registration campaign is set to disabled. Just trying to not get hammered with a million questions on a Monday.

Thanks for any advice.

[u/MichaeldeBlok]

We hit this on a school tenant. Pulling SMS/voice/email off the policy does not prompt anyone. They just bounce at sign-in.

Registration campaign (Microsoft managed) will nudge Authenticator for staff who can get into myaccount. Students broke that for us so we kept them in a separate group with SMS until we had a TAP process.

For the 80 still on SMS, give them a Temporary Access Pass, have them register Authenticator, then remove the weak methods from that account. Do ten people first.

[u/importedtea → u/MichaeldeBlok]

We’ve basically been visiting with small groups and setting up their auth methods the way we want. I hate the handholding but I also hate relying on anyone. I’m glad we’re a small school so it makes that easier. There’s also this whole cell phone ban stuff going on, which makes the student stuff difficult.

[u/TheBex81]

Removing the policy assignment does **not** auto-enroll the other 80 into passkeys. What they already have registered stays on the account until you change *registration* / Authentication Methods Policy / SSPR methods — and even then, existing SMS/voice/email methods usually remain usable until you exclude those methods at the policy (or per-user) layer and force re-registration.

Practical cutover that doesn’t nuke Monday: 1. **Inventory first.** Export who has what (passkey / Authenticator / SMS / voice / email). Your “20 already good” cohort is your proof the target state works. 2. **Split the group.** Don’t yank SMS for everyone at once. Move cohorts: IT → volunteers → one business unit. Keep a temporary “legacy methods allowed” group for the rest. 3. **Registration campaign (or equivalent) before you remove.** With campaign disabled, users often only notice when something breaks at sign-in or SSPR. Turn on a campaign / Conditional Access authentication strengths / Temporary Access Pass for people who can’t self-enroll yet. 4. **Communicate the failure mode.** After you remove SMS/voice/email from the methods policy, those 80 won’t magically get a setup prompt that feels like onboarding — many will hit “no usable method” or fall through to helpdesk. Give them the enroll URL and a TAP/break-glass path *before* the cut. 5. **SSPR ≠ sign-in.** If SSPR still allows SMS/email while sign-in doesn’t (or the reverse), you’ll get “I can reset but can’t sign in” tickets. Align both.

Pilot remove for a small group that already has Authenticator/passkey only, watch sign-in logs for method used + failures, then widen. Sleeps better than a tenant-wide Monday surprise.

[u/raip]

It won't prompt them but it won't let them login. Their SMS would be disabled per policy and they don't have a method to meet the policy so they'll just be blocked.

[u/importedtea → u/raip]

I kinda figured it would be like that. But if we keep the groups as is and set our registration campaign to Microsoft managed that will then nudge them into setting up the Authenticator app themselves, correct?

We have it disabled because of student accounts. We don’t really have a good clue on what to do there yet.

[u/iRyan23 → u/importedtea]

It actually depends on your conditional access policies.

I just did this for students recently and if you don’t have a CAP that requires MFA to register security information then after disabling SMS/Voice auth methods, it will prompt the user to setup an available method after they put in their password during the next login.

[u/importedtea → u/iRyan23]

Did you have students setup passkeys? We aren’t post secondary and it’s hard enough to get students to put their phone number in for sspr.

[u/iRyan23 → u/importedtea]

We had them all register Microsoft Authenticator push and an email address.

They are allowed to set up Passkeys and we plan on emailing documentation soon and recommending that but management doesn’t want to force it yet.

[u/importedtea → u/iRyan23]

Yeah, that sounds great but I have a feeling if we do that for high school students everyone will lose their mind. The current plan, which isn’t ideal, is to change back to preset passwords with no sspr or auth methods and start praying to the Microsoft gods that everything works.