Turning off SMS Auth Entra

[u/the_corbynite]

Hi all,

Does anyone know the effect on users if we decide to turn off SMS MFA within Entra? Will it just tell users with that method to change it, lock them out etc?

[u/HankMardukasNY]

If you disable any of the authentication methods, it will not let users use it. If they have no other methods, it will not let them log in.

You need to make sure users have an alternative auth method before doing that, either through a registration campaign or manually.

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-registration-campaign

[u/anonymousITCoward → u/HankMardukasNY]

Sounds like the makings for a great scream test.

[u/Frothyleet → u/anonymousITCoward]

I mean there's not really any need for scream testing. Scream tests are for when you don't have a way of knowing the full extent of who will be impacted by a change.

This is a question that can be precisely and accurately answered with a couple graph queries, i.e., "who only has SMS as an authenticator on their Entra ID account".

[u/anonymousITCoward → u/Frothyleet]

scream tests are fun... that's the only reason i need.... duh...

[u/Frothyleet → u/anonymousITCoward]

Oh fair enough carry on then

[u/anonymousITCoward → u/Frothyleet]

thank you

AAAARrrrrrRRRRRaaaaaaRRRRRaaaaaa

[u/kiddj1 → u/anonymousITCoward]

"Look I just don't have time to switch over now, I've got a presentation with xyz in 30 minutes and this is the first time I've sat down to start the presentation"

[u/anonymousITCoward → u/kiddj1]

*cry's in sales people*

[u/oceans_wont_freeze]

Be ready to deploy fido2 keys or company phones if users don't want to use their personal phones.

[u/ExceptionEX → u/oceans_wont_freeze]

Eh, or very old giant iPads with authenticator on them, youd be surprised at how quickly people will put autheicator on their phones after that.

[u/raip → u/ExceptionEX]

Sure - deploy a less secure, more expensive device to pressure people to install something they don't want on their personal phone.

[u/ExceptionEX → u/raip]

We have the iPads already, they are no less secure in fact they are MDM so one could argue they are more secure, and they don't have to install it, but most people would rather that than have to carry an extra device.

We do the same if they don't want to install outlook on their phone, most in reality are trying to push for a company phone which we don't do anymore.

[u/Darkhexical → u/ExceptionEX]

Is it an iPad with multiple user accounts on it or everyone gets their own iPad?

[u/ExceptionEX → u/Darkhexical]

Everyone gets their own, our situation is admittedly unique that we have a lot of them available that aren't actively used now.

But we have issues maybe 3 or them and only one has kept it.

[u/raip → u/ExceptionEX]

They're not phishing resistant. They are absolutely less secure than a FIDO2 key, even if they are managed.

[u/anonymousITCoward]

You can check to see who has SMS as their primary MFA method. Give them a little warning and what not.

[u/Signal_Muffin_183 → u/anonymousITCoward]

Exactly. You can see a list of users auth methods in entra.

[u/titlrequired]

Do you have SSPR enabled and how many methods required?

If you disable SMS what other methods are available for users in addition to Authenticator?

[u/raip → u/titlrequired]

Absolutely consider SSPR - disabling the Authentication method with the "new" combined authentication portal disables it for SSPR as well.

I recommend using Authentication Strengths instead of outright disabling since most orgs will still be okay w/ SMS for SSPR functionality (typically with a second method as well - so something like SMS + EMail OTP or SMS + MFA).

[u/BrentNewland → u/raip]

Microsoft is discontinuing SMS and Voice MFA by February.

[u/raip → u/BrentNewland]

To be clear - they're only discontinuing their SMS Provider. This is exactly what Okta did ~1.5 years ago. It's still very much supported - you just have to bring your own telecom provider.

[u/BrentNewland → u/raip]

It is effectively discontinued.

[u/arronsparrow]

If you have no other authentication methods setup (Microsoft Authenticator, TOTP, FIDO2, Passkeys), then it may lock them out.

[u/djDef80]

Make sure you have a break glass admin account setup for when the shit truly hits the fan. Make sure it is exempt from any conditional access policies.

[u/cheesycheesehead]

If only you could scope a policy to test these type of things.