non-admin help desk manage user mfa settings

Hi Razzi,

To empower your Help Desk staff to manage users' Multi-Factor Authentication (MFA) settings in the Microsoft Entra Admin Center without assigning the Global Administrator role, consider the following approaches:

1. Assign the Authentication Administrator Role:

The Authentication Administrator role permits users to manage authentication methods for non-administrative users. This includes adding or modifying phone numbers used for MFA, resetting passwords, requiring users to re-register for MFA, and revoking existing MFA sessions.

Limitations:

• This role does not grant permissions to manage authentication methods for users with administrative roles.

1. Assign the Privileged Authentication Administrator Role:

The Privileged Authentication Administrator role extends the capabilities of the Authentication Administrator by allowing management of authentication methods for all users, including those with administrative roles.

1. Create a Custom Role:

If the built-in roles provide more permissions than desired, you can create a custom role tailored to your organization's needs. However, as of the latest updates, certain permissions related to managing user authentication methods may not be available for selection when creating custom roles. It's essential to verify the current availability of these permissions in your Microsoft Entra environment.

Steps to Create a Custom Role:

1. Sign in to the Microsoft Entra admin center with at least the Privileged Role Administrator role.
2. Navigate to Identity > Roles & admins > Roles & admins.
3. Select + New custom role.
4. On the Basics tab, provide a name and description for the role.
5. On the Permissions tab, select the necessary permissions related to managing user authentication methods.
6. Review and Create the role.
   https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-create?tabs=admin-center

Recommendation:

Assigning the Authentication Administrator role is a practical approach to grant Help Desk staff the necessary permissions to manage MFA settings for non-administrative users. If there's a need to manage MFA settings for all users, including administrators, the Privileged Authentication Administrator role would be more appropriate. Always ensure that roles are assigned following the principle of least privilege to maintain security.