Enforce the user to enter their security info before MFA is enabled

[Michal_Z]

The question is very simple:

Can I enforce the user to set up their Security info from a sign-in prompt a few days before I enforce the user to use MFA?

I am preparing the MFA rollout and I can see Microsoft documented the process of how to Set up your Security info from a sign-in prompt. By the way, the user experience which is documented over there can be seen on new tenants or after you enable combined security information registration in Azure Active Directory at your old tenant.  

The very first screen on that page triggered my curiosity on how to make it before the MFA is enabled for the user. I found the article Combined security information registration for Azure Active Directory overview where there is a use case I need to implement, but not documented. 

Can you tell me if this is possible and If yes, give me a tip on what to do to make it happen, please?

By the way - the Require Re-register MFA option when the user is not enforced to use MFA doesn't trigger this setup security info request during the sign-in process. 

[#2 · Accepted solution]

One way is to do this through Identity Protection (it requires a P2 license though) => https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protectio...

Know that you can also preprovision MFA for a user. This is a pretty cool way to do it => https://janbakker.tech/prepopulate-phone-methods-for-mfa-and-sspr-using-graph-api/

[#3]

@Thijs Lecomte 

Great content. Thx a lot. I will go through it tomorrow. But I already see the value.