If you use Always ON MFA, then you can set the user to Enforced. The “Authentication Methods” page displayed in > Azure Active Directory > Users, allows you to pre-define the phone number that would be used for MFA.

You might issue a T emporary Access Pass to allow users to register passwordless methods without knowing the password to the account.įor more information on planning a passwordless deployment, click here: Įver wonder what is required to pre-register a user for Phone or Email? The most ideal scenario would be to deploy Passwordless MFA, such as Windows Hello for Business, Authenticator App, FIDO2 Keys, or Certificate (Preview). If you want to learn why phone number verification is weak, check out the Microsoft Article:

This is not recommended but in some organizations, they are unable to avoid this for a variety of reasons. This article describes how to make the user onboarding experience into MFA as smooth as possible by pre-registering MFA methods.ĭisclaimer: This article only applies to organizations that have decided to use Phone Number for verification.

Mfa for active directory