Changes to the Registration campaign feature in Azure AD

Question

Publicly switched telephone networks (PSTN) such as SMS and voice authentication are the weakest forms of MFA. To help your users move away from them we are introducing changes to the Microsoft managed state of the Registration campaign feature in Azure Active Directory.

When this will happen:

July 10, 2023

How this affects your organization:

Starting July 10th, 2023, users in your organization that are relying on SMS and voice for MFA will be prompted to use the Microsoft Authenticator app. They can skip this prompt for a maximum of 3 times, after which registration of the app will be required.

What you can do to prepare:

We urge you to motivate your users to stop using SMS and voice for MFA. However, if some of your users need more time you can exempt them for now. Sign in as Global Administrator or Authentication Policy Administrator and go to Azure AD > Security > Authentication methods > Registration campaign and exclude these users.

[Question]
If your current in process of switching over from Legacy Multifactor Authentication to authentication methods policy how will this affect end users?

Answer 1

The changes we have introduced relate to the registration campaign feature. For any organization with the state set to Microsoft managed, we are enabling the campaign for users that are fully dependent on PSTN methods (SMS and voice) for their MFA. Those users will then be prompted to start using the Microsoft Authenticator app, a faster and safer way to sign in.

These changes have deployed to most organizations, with the deployment to remaining organizations happening before October 20, 2023. It is possible to exclude users and disable the feature altogether, for which I like you to refer to our public documentation: https://learn.microsoft.com/azure/active-directory/authentication/how-to-mfa-registration-campaign

There are no plans to discontinue SMS and voice.

Answer 2

@Matthew John Earley BSc (hons)

Thank you for posting your query on Microsoft Q&A, from the above description I could see that the post (Publicly switched telephone networks (PSTN) such as SMS and voice authentication are the weakest forms of MFA)you are referring to is from 2020, suggesting to move from Phone (PSTN) based MFA To authenticator app but does not enforce any change.

We already have authenticator and token based authentication now (as its been 3 years since this was posted). So no actions are needed from Org Admins on this.

For any upcoming deprecation please keep yourself posted on What's deprecated in Azure Active Directory?

• For any upcoming changes please keep yourself posted on What's new in Azure Active Directory?
• In order to use registration campaign of all pre-reqs following are meant to be fulfilled:
  • MFA Registration Policy: Users will need to be enabled for Notification through mobile app.
  • Authentication Methods Policy: Users will need to be enabled for the Authenticator app and the Authentication mode set to Any or Push. If the policy is set to Passwordless, the user won't be eligible for the nudge. For more information about how to set the Authentication mode, see Enable passwordless sign-in with Microsoft Authenticator.
  As described above if you have set Authentication Methods "Migration in Progress" state then, legacy MFA policy will be taking precedence, however SSPR and first factor would go through Authentication method.

  Users will not be nudged, if using legacy MFA.

  Hope this answers your question. Please do let me know if you have any further queries by responding in the comments section.

Please do let me know if you have any queries by responding in the comments section.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

Answer 3

The setting for the Registration campaign is disabled. Yet a few users are still getting prompt to set up the Microsoft authenticator. I don't how that is even possible.

Answer 4

I have enabled "Limited number of snoozes" but still users can postpone Authenticator registration unlimited times.

Answer 5

@Matthew John Earley BSc (hons)

Will users with registered FIDO keys also be affected by this registration campaign - will they be prompted to install the Microsoft Authenticator?