Forum Discussion
Sketchy behaviour from Microsoft on MFA - what gives?
Recently, Microsoft has overwritten our Authentication Method Registration campaign settings, from 'Disabled' to 'Microsoft Managed' for dozens of tenants. Thanks guys. That's not super sketchy at all. /s
This was ostensibly done for the Retiring of Voice and SMS based MFA or, as the article puts it 'To help enterprises adopt AI at scale,'.... what? Not because they're garbage MFA methods? But so Microsoft can market-capture MFA?
Regardless of that bizarre statement, this article is sub par - like most Microsoft 'help' docs, it appears to have been written by someone in Marketing, with no technical experience. My chief concern is that the term 'OTP' doesn't appear ANYWHERE in here. So, for us and our customers - who block Voice/SMS already - this is alarming. Microsoft's Passkey flow is confusing af to people - and since it includes SYNCED passkeys by default, it faces the same risks as OTP. We specifically HAVEN'T rolled out passkeys because everytime we do, people get confused and frustrated - because they'll have 3-4 different things pop-up, offering to take a sync'd passkey.
Really concerned with my 'do not allow microsoft to manage' setting, being explicitly set to 'Microsoft managed', and whatever decisions they're NOT publicly addressing at this point. We've spent years teaching people to use Microsoft Authenticator and password vault-based OTP. Now, Microsoft is pushing everyone to keep using those same tools, but to go through the mess that is the passkey setup interface?
1 Reply
Your concern is whether existing Authenticator/OATH users are being forced into passkeys after a tenant policy change. Microsoft's current SMS/voice retirement FAQ states that TOTP remains supported for existing and new registrations after February 1, 2027, subject to organizational policy. Users who register and use TOTP for MFA do not receive the blocking passkey prompt aimed at SMS/voice-only users.
The rollout scope checks whether users remain enabled for SMS or voice in authentication-method or legacy MFA policies. After testing their replacement method, remove unnecessary SMS/voice scope to prevent further nudges. Also review registration-campaign targeting and effective passkey profiles per tenant.
Synced passkeys remain phishing-resistant; their recovery and synchronization risks do not make them equivalent to phishable OTP codes. Device-bound profiles provide a different control when required.
I cannot establish why your explicitly Disabled campaign changed without tenant audit evidence. Preserve before/after policy exports and change timestamps for Microsoft support.