Cool enhancements to the Azure AD combined MFA and password reset registration experience

robynhicock,

It is super disappointed we are still waiting for this. We do not want to use SMS. Ideally Questions or Mobile OTP/Push. I get the reason why (not enough people have moved to the new experience) but why haven't you just forced the new experience. Other MS teams are moving my cheese all the time, this one seem so basic, the new experience is far better, why not force it on all tenants? To my knowledge you don't lose anything going to the new UI. Previews should last 6 months not 6 years lol... In the time we have been waiting for the "You must enable another method to use mobile app or hardware token code" restriction to go away the world actually changed, SMS is no longer considered safe and true Passwordless is around the corner. 

As a side note have you thought about how Temporary Access Pass plays into this? We are starting to think the ideal password reset workflow doesn't involve security questions at all (which also can suck pretty bad) but instead helpdesk or manager generating TAPs then users use that to use password reset tooling. Hopefully you are thinking about that and hopefully the turnaround for that wont be measured in years.

robynhicock  We are waiting also, started to let users switch to Authenticator App because SMS is no longer safe, but now we can't require SSPR because we only want to use App and security questions. Could you supply an ETA?

Hi robynhicock , just wanted to ask if there was any update on the "You must enable another method to use mobile app or hardware token code" restriction?  We're trying to get approval to enable Azure SSPR but we don't want "email" to be an option.  We just want mobile app code + security answers.

On a related note, we want the mobile app code to be from the Microsoft Authenticator App only, however during SSPR registration you can choose a different authenticator app if you wish.  Is there a way of restricting the users to using the Microsoft app only?

Final question... does "mobile app code" mean only OTP generator apps can be used?  Or, could someone use this option with an app that phones the user to simply press # to authenticate?  (We want to avoid the latter).

andy247 - We can get rid of that SSPR restriction once more tenants are enabled for combined MFA/SSPR registration. We're automatically opting in all new tenants since August 15th, and we'll start a roll out for existing tenants in September. Then we can remove that SSPR rule that requires another method to use the auth app.

Hi robynhicock, I hope all is well.  We too would like to see the back of the "You must enable another method to use mobile app or hardware token code" restriction.  In an ideal would, we would like to enforce the use of security questions and token (RSA or MAA).  We don't want SMS or email to be an option for our users.  Do you have an indication of when this might be resolved?  We're at a critical point in deciding on our SSPR solution and we don't want to choose something non-Microsoft if we don't have to.  Thanks!

cmessina85 and aidancopps and Brian Reid - Thanks for reporting this! Unfortunately that error "You must enable another method to use mobile app or hardware token code" is because of us supporting the old and new registration flows. The old SSPR registration flows don't support the Auth App, but the new flows do. So without that error, users could potentially land in the old flows and be required to register an Auth App even though the UX won't let them. We're discussing right now how to best fix this issue. We might just remove that error if all users in a tenant are enabled for the new Combined MFA/SSPR registration. That way, no user would land on the old flows. 

Brian Reid Sorry my question wasn't that clear. I meant the system doesn't let us tick Authenticator Code, Authenticator Notification and another option such as Secret Questions - and then select to require 2 methods. It sounds like it doesn't let you do this since the non-converged setup process doesn't let users configure the Authenticator app.

aidancopps as the Authenticator app provides both push and a code when registering, SSPR cannot have push and a code as two separate methods even if you use the code from a hardware token because the system does not equate which device it comes from. That is, once you do a push then any code is not an option and disappear from the reset wizard as otherwise there is nothing to stop you using the code from the authenticator app and thus not having two separate methods 

Hi Sadie Henry is there any update you can share on when the Authenticator app will count towards the SSPR methods we allow users to use? We are using the converged experience but still getting the You must enable another method to use mobile app or hardware token code message when we try to require 2 methods including the Authenticator app. Thanks!

robynhicock running through mysignins security page works ok on my iphone on Edge, chrome and also Safari but only in private mode.

If i run normal safari i get the error "An unexpected error has occurred". Unfortunately iOS only have safari as default web browser for all links so sending it to an iphone user gives the above error but if they copy paste to either private or other browsers it works. What is this all about?