Office 365 Admin Role Needed for MFA

[ChrisP1975]

I would like to assign members of the help desk access to manage MFA for non-admin users.  I already assigned the Authentication admin role and this partially works.  Right now the help desk can go into AAD, switch to Authentication methods and do everything that is needed there.

However, as a Global Admin from the Microsoft 365 admin center I can see Users > Active Users > Multi-Factor Authentication and I can manage Manage multifactor authentication from the User itself.  These options are not available for the help desk.

Is there another role that I can use to grant access to the legacy MFA management portal?

[#2 · Accepted solution]

None of the "specialist" roles are able to manage users in the legacy MFA portal, as detailed here: https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

[#3]

So is the answer
"You must be a global admin in order to do this?"

[#4]

I am using Authentication Administrator to grant my help desk team access to make changes to MFA.

[#5]

@ChrisP1975 

I have given my employee every single admin right except for global admin and they can see the MFA page and see the users and whether they have MFA enabled or not but he cannot change anything. THe options are greyed out. 

I guess you have to give someone global admin to be able to make changes to MFA....

Is MS stupid or is it broken, Which is it?

[#6]

@ChrisP1975 

The Authentication Administrator should do, for all general users.

Use the Privileged  Authentication Administrator role for admin privileged accounts.

[#7]

Nope, like I said, I gave my employee all of the admin privileges including the Authentication Administrator and he could not change the MFA settings. Once I gave him global admin, he was able to do that task.

[#8]

@brianzx7 

I had the same issue and found this article.

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userdevicesettings
hope this explain this article will help.

Usually, your helpdesk will not go to the portal of MFA Per user this is for global admin role, they will reset the MFA, via Azure under Users > Select Users > Authentication Method and click Require re-register multifactor authentication button.

Your helpdesk needs a role, Global Reader Role - to access users and Authentication Admin Role so they can re-register the MFA.

Cheers!!

[#9]

@mhikolet 

I looked at that article and gave my limited admin the Authentication Administrator role. I don't think you have to give them global reader as long as you provide the url to the azure ad portal. I don't see anywhere in azure ad where you can set MFA to enabled or enforced. Which is what I believe the original poster is looking for. I would also like to be able to set up a limited admin to do this task. Create the user, license the user, enable MFA. Then when the user first logs in they have to set up MFA. Am I missing something in Azure AD? Require re-register nor revoke authentication appears to change the Multi-Factor Auth Status to enabled for the user.

[#10]

@lspot I was all so trying to do this. So nothing short of God mode will do. Great job Microsoft. 

[#11]

I found a solution to this.

From this post:https://learn.microsoft.com/en-us/answers/questions/325505/allow-support-users-to-enable-mfa-for

"To allow help desk users to enable per user MFA via Multi-factor Authentication Portal, you need to assign both directory roles mentioned below:

Authentication Policy Administrator: This role will allow access to Multi-factor Authentication Portal but won't allow enabling/disabling per-user MFA.
Privileged Authentication Administrator: This role allows enabling/disabling per-user MFA."

[#12]

acerimeli's solution worked for me. Although you have to give them the path to the MFA portal. https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx
The link doesn't show up at the top of the user list like I'm used to seeing as a global admin.
The Privileged Authentication Administrator Role seems pretty innocuous, but curious what people think of the Authentication Policy Administrator. Is that just big words for can enable and disable MFA for anyone in the tenant?