Forum Discussion
Staged Rollout to Passthrough changing users MFA methods
Hi, I am in the process of helping a customer migrate their ADFS relying parties to AAD and also migrating their users to passthrough auth from federated. We have had instances from around 10-20% o...
this tenant isn't using the combined registration feature at all yet. I have suggested it is worth looking at for them from a user experience standpoint.
Hi Peter,
Thanks for the response.
I have seen the behavior you are mentioning regarding a text message, but that's only when a user has never signed in before and his or her phone number is configured by an administrator under the authentication methods.
If they don't want to use the SMS option at all, why is it configured as a method? Is there a possibility to turn it completely off (via the Per-user MFA option and via the Authentication methods in Azure AD).
And what you can try, is to turn on the Combined registration only for a handful of users (or yourself). To reproduce if the issue still persists. Soon or late they will ask you to implement this feature. Besides that, it will ask users to verify their authentication methods, and the behavior might be the same as before (authentication app) instead of SMS.
Please let me know if you have tested the above.
Thanks for the response.
I have seen the behavior you are mentioning regarding a text message, but that's only when a user has never signed in before and his or her phone number is configured by an administrator under the authentication methods.
If they don't want to use the SMS option at all, why is it configured as a method? Is there a possibility to turn it completely off (via the Per-user MFA option and via the Authentication methods in Azure AD).
And what you can try, is to turn on the Combined registration only for a handful of users (or yourself). To reproduce if the issue still persists. Soon or late they will ask you to implement this feature. Besides that, it will ask users to verify their authentication methods, and the behavior might be the same as before (authentication app) instead of SMS.
Please let me know if you have tested the above.
- Hi, I think wires are crossed due to the mention of not wanting to use the SMS method.
The core issue is that some users who have previously configured app notification in Azure MFA, when enabled for PTA staged rollout are then changed to SMS, as if their MFA is reset or rolled back.
The audit logs are clear as mud but possibly its showing an update to the strongauthenticationmethods for some of these users by AD connect.- Hi Peter,
The issue you currently dealing with was clear to me. Excuse me If it looked like it didn’t.
I am wondering if the value for strong authentication changes when adding someone to the staged rollout group. Could you try to run the below Powershell before and after the user gets added to the group and check the differences in the values?
Connect-MsolService
$User = Get-MSolUser -UserPrincipalName user@domain.com
$User.StrongAuthenticationMethods
