Delegate Azure AD MFA administration

[Cristian Vergara]

Hello community

I would like to have your feedback as we are currently looking to delegate some tasks under Azure MFA like disable users and upload OATH Tokens.

Currently the least privileged role to perform this actions is a Global Administrator account, I was checking the Azure Roadmap and I couldn't find details to confirm if this feature is planned to be rolled out.

Do you know if this is planned to arrive in the near future?, any ETA or to be part of a preview would be interesting.

Any comment is welcome!

Thanks.

Cristian

[#2]

If you require MFA via a conditional access policy you can define included and excluded groups, then delegate the management of those groups. We also use Flow to remove people from an exclude group each night so they only get 1 days access to get themselves back.

[#3 · Accepted solution]

A new API is coming (in Preview currently) that will finally allow us to delegate/automate Azure MFA management. No ETA has been shared yet though.

[#4]

Thanks Steven

Really useful insights!, we have Conditional Access rules in place to apply MFA.

The thing is that some users are marked as Enabled under MFA, we need to change the status to Disabled in order to get CA rules apllied correctly; also some users have a Hardware token that needs to be assigned under AAD -MFA Interface.

We would like to delegate this tasks with a least privileged role than Global Admin.

Thanks!

Cristian

[#5]

Thanks Vasil!

Just to make sure I'm checking at the right place, any updates about this preview should be available at the Azure blog right?.

Best regards.

Cristian

[#6]

Any update on the release date for this?

Was mentioned in December that it was in private preview with more new soon.

[#7]

@Vasil Michev any updates? 

[#8]

Any updates on this feature? @Vasil Michev 

[#9]

Hi @tweso

Today I found out that there's a new role called Authentication Administrator in preview.

This role allows you to perform several tasks like:

- View, edit and reset the authentication methods for users in AAD.(including MFA)

But for other tasks like enable/disable OATH Tokens you still need a member of the Global Administrator role.

Cheers!

Cristian 

[#10]

Yeah, this is something that is sorely missing

I need to be able to grant permissions for our Service Desk staff to be able to deploy OATH tokens. There's no way that I want to give them Global Administrator just for that! :)

Any further updates @Vasil Michev ?