Forum Discussion

Jez Blight's avatar
Jez Blight
Copper Contributor
Jan 20, 2018

Office 365 Admins and MFA - Restrict to use App only, not allow SMS or voice?

Hi, I'm wondering if it's possible in Office 365 w. E3 licence to setup MFA for Admins so the only authentication method they can use is app only (e.g. Azure Authenticator), not SMS or voice. All other non- admins should be able to use any method.
Does anyone know a way to do this? The articles I've read indicate that MFA is global for all users no matter what privilege they hold, but there must be a way?
Thanks in advance
Authentication
office 365
security

6 Replies

  • PBeiler1's avatar
    PBeiler1
    Iron Contributor
    Jan 22, 2018

    I setup my O365 E3 IDs individually turning off/on MFA for each ID.  Since Microsoft has released PowerShell modules that accept MFA connection for Exchange and Skype, I've found MFA workable for Admin IDs.

     

    I have also found Outlook on the desktop and Skype 2016 on the desktop ... to work nicely with MFA.  I had to change a MFA setting in Exchange and Skype, because my O365 setup has been around since the beginning and the setting was turned off by default.

  • VasilMichev's avatar
    VasilMichev
    MVP
    Jan 20, 2018

    Nope. You can disable specific methods, but the configuration will indeed apply to all users.

    • Kevin Taber's avatar
      Kevin Taber
      Brass Contributor
      Jan 21, 2019

      Where is the setting found to restrict globally to mobile app? I don't want to involve SMS text messages or phone calls.

      • Kevin Taber's avatar
        Kevin Taber
        Brass Contributor
        Jan 21, 2019
        Never mind... I found it here:

        https://docs.microsoft.com/en-us/office365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide
    • Jez Blight's avatar
      Jez Blight
      Copper Contributor
      Jan 21, 2018
      Hi Vasil, thanks for confirming. Is there any 2FA solution you could recommend trying? Thanks again,
      • VasilMichev's avatar
        VasilMichev
        MVP
        Jan 21, 2018

        The Server (on-premises) version of Azure MFA allows you to configure the default method for each user, so if you block all others the will only be able to use the app. However, the block settings will again apply to all users.

Resources