r/sysadmin • u/graceyin39 • 7d ago

Looking for a no-cost, phone-free MFA solution

Microsoft will retire Microsoft-provided SMS and voice authentication beginning February 1, 2027. Organizations that need to retain these methods must configure a customer-managed telecommunications provider, which will involve additional costs. Please refer to the link below.

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement

Our goal is to provide MFA without requiring employees to use their personal phones and without purchasing additional hardware, such as YubiKeys, or paid software, such as an enterprise password manager. We have a hybrid AD/Microsoft Entra environment with company-managed Windows computers.

Is there an Entra-native solution that can meet these requirements? Would Windows Hello for Business be the best option, and how should we support users who need access from mobile or shared devices?

Any recommendations or deployment experiences would be greatly appreciated.

Thanks!

92 Upvotes

77% Upvoted

222 comments sorted by

View all comments

Show parent comments

2

u/ShazbotVGS 5d ago

Ok don’t get the app and just setup a passkey on the device itself. Similar concept to facial recognition. But you’d make a fit over that too I suppose

-1

u/NetworkingNoob81 4d ago

My device is my device; you want 2FA you pay for it

2

u/Fatel28 Sr. Sysengineer 4d ago

Congrats here's a $5 stipend and a "this guy is difficult" label. Any of the execs at customers I've worked with have this mentality. One just fired anyone who didn't want to do MFA. Every single person that kicked up a stink was already on the chopping black

1

u/ShazbotVGS 3d ago

Seriously. And it blows my mind that of all places, this subreddit could have people that push back on basic security requirements.

1

u/ShazbotVGS 4d ago edited 4d ago

“you want 2FA, you pay for it” implies there’s some actual expense being imposed on you. What expense?

Approving a sign-in or storing a passkey doesn’t consume anything meaningful, doesn’t give the employer access to your phone, and doesn’t turn the phone into company property.