How can I require EntraID users to register more than one authentication method?

Question

Most of our EntraID users have only one method registered when we advise at least two . Is there a way for me to force them to register at least two methods? Any guidance on the best approach would be appreciated.

Answer 1

Hello Jude Cosh-Wood,

Thanks for your question.

To enforce this, I will recommend rolling out an MFA registration campaign. In the MFA Registration campaign, Users will be enforced to register for MFA based on the set limits provided by you the Admin.

• In the Entra admin center, navigate to Security > Authentication methods.

Locate Registration campaign.

This feature allows you to prompt users to set up an authenticator app (like Microsoft Authenticator) after successful logins.

Configure the campaign to target specific users or groups.

You can also set snooze options to allow users to postpone enrolling in the app temporarily.

See: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-registration-campaign

This can also be combined with your MFA registration Policy. See setup here:

https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy

However, pls note that the MFA registration policy enforcement requires a p2 license. To enforce the MFA registration policy, ensure that the users targeted by the policy have a plan with P2 enabled.

Please let me know if you have further questions**

You can mark it 'Accept Answer' if this helped.