Have you seen the Combined Registration for SSPR/MFA? It's really quite lovely. My favorite thing about it is you can have the registration wizard prompt the user to download and configure the Microsoft Authenticator App as their default MFA method!
The old MFA registration defaults to SMS and you have to somehow convince users to dig through their account settings to set up the auth app. Many of our folks didn't do it and lost access when they traveled overseas where SMS was not available/turned off.
There's one sticky little issue...
In order to use Microsoft Authenticator as an SSPR recovery method you must require two recovery methods in your tenant. We've already got 6500 users, in dozens of countries, speaking several languages using SSPR with one recovery method. When I update our tenant to require two methods, none of the users with one method can reset/recover their accounts until they've registered a second method. Instead, when they click forgot password and enter the captcha they get an error screen that say, 'You can't reset your own password because the password reset isn't turned on for your account.'
We’ve been spit-balling ideas from just letting it break (they can work with their office IT admins when it does), to doing a campaign to populate two methods before the MFA campaign, to populating a second recovery method with dummy data (an unmonitored email account or phone number). We don’t really like anything we’ve thought of yet. Have you run into this? Were you able to come up with a non-intrusive solution?
