Restrict Global Admin MFA Methods

shannonhamby Hi, well for what it's worth this is the guidance for protecting your global administrator accounts https://docs.microsoft.com/en-us/microsoft-365/enterprise/protect-your-global-administrator-accounts?view=o365-worldwide

As to separate them using different secondary authentication methods I'm only aware of the authenticator app being the default and only option when using the built-in "Security defaults", that is if you don't configure the MFA service settings so that when your users enroll their accounts they choose their preferred verification method from the options that you have enabled https://docs.microsoft.com/sv-se/azure/active-directory/authentication/howto-mfa-mfasettings#enable-and-disable-verification-methods

When using legacy MFA it's per-user and best practice is you should be using either Security Defaults or Conditional Access policies to require MFA.

MFA support in Microsoft 365 (plans)
https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/multi-factor-authentication-microsoft-365?view=o365-worldwide#mfa-support-in-microsoft-365 

Using these methods together (enabled/disabled)
https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/multi-factor-authentication-microsoft-365?view=o365-worldwide#using-these-methods-together 

Perhaps not what you're looking for but hopefully getting you in the right direction.