Office 365 Admins and MFA - Restrict to use App only, not allow SMS or voice?

Question

Hi, I'm wondering if it's possible in Office 365 w. E3 licence to setup MFA for Admins so the only authentication method they can use is app only (e.g. Azure Authenticator), not SMS or voice. All other non- admins should be able to use any method.
Does anyone know a way to do this? The articles I've read indicate that MFA is global for all users no matter what privilege they hold, but there must be a way?
Thanks in advance

vasilmichev · Answer

Nope. You can disable specific methods, but the configuration will indeed apply to all users.

jez blight · Answer

Hi Vasil, thanks for confirming. Is there any 2FA solution you could recommend trying? Thanks again,

vasilmichev · Answer

The Server (on-premises) version of Azure MFA allows you to configure the default method for each user, so if you block all others the will only be able to use the app. However, the block settings will again apply to all users.

pbeiler1 · Answer

I setup my O365 E3 IDs individually turning off/on MFA for each ID.&nbsp; Since Microsoft has released PowerShell modules that accept MFA connection for Exchange and Skype, I've found MFA workable for Admin IDs.
&nbsp;
I have also found Outlook on the desktop and Skype 2016 on the desktop ... to work nicely with MFA.&nbsp; I had to change a MFA setting in Exchange and Skype, because my O365 setup has been around since the beginning and the setting was turned off by default.

kevin taber · Answer

Where is the setting found to restrict globally to mobile app? I don't want to involve SMS text messages or phone calls.

Forum Discussion

Office 365 Admins and MFA - Restrict to use App only, not allow SMS or voice?

Share

Resources