Auth MFA migration

Question

Hello,

I have some queries where I'm planning process of transitioning from legacy Multi-Factor Authentication (MFA) and Self-Service Password Reset (SSPR) Migration and following this document - https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-methods-manage

I want to understand few things before migrating as we are also using conditional access policies to control MFA.

1. Will there be any changes in CAP after the migration?
2. Will users be prompted to register for a new authentication method after migration?
3. Will the SMS authentication method still be available after migration?

Please share any MS article or official document to support this, Many thanks

Answer 1

Hello @Raymond,

I understand that you're planning a migration from legacy Multi-Factor Authentication (MFA) and Self-Service Password Reset (SSPR) to the modern Authentication Methods policy in Microsoft Entra ID, and you’ve had few questions-

Will there be any changes in CAP after the migration?

Migration from legacy to modern authentication methods policy is only about the methods you use for completing the authentication which will not affect CAP as CAP is only a way to enforce MFA. MFA registration is different from MFA enforcement. So, there is no effect to conditional access policies after migration. There is not available Microsoft Document for the question as there is no link between conditional access policy and the authentication methods migration.

Will users be prompted to register for a new authentication method after migration?

Users would not be prompted to register for a new authentication method, if the existing authentication methods and password reset methods are matching the new authentication methods policy. Users would be prompted if there is a difference in legacy methods policy and modern authentication methods policy. https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-methods-manage

Will the SMS authentication method still be available after migration?

Legacy MFA policy and legacy SSPR policy already have SMS authentication available. This method is also available in the new authentication methods policy. You need to navigate to Microsoft Entra ID > Security > Manager > Authentication Methods Policy > SMS > Enable (Check all users or groups you would like to use for SMS)

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-methods-manage#sms-and-voice-calls

Before migrating to the modern authentication methods policy, it's essential to ensure that all authentication methods currently enabled in the legacy MFA and legacy SSPR policies are also enabled in the modern policy. This alignment guarantees a seamless transition and ensures that end users do not experience any disruptions or loss of access during or after the migration.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".