Priv Auth admins cant change authentication settings for regular users

Question

Hello,

I have been granted authentication admin and privileged auth admin by my global admin and I can no longer change the authentication settings of users (enforced, enabled, disabled) for anyone, including non-admin users. This happened after a recent change to the look of the website to match the overall aesthetic of entra so I was wondering if there was a permission change to these roles or if its just broken and Microsoft needs to fix it.

I can confirm I can still require reregister - I just cant require that users authenticate with the authenticator and have been raising these up to my global admins to do so.

Any help you can provide is apricated because I'm at my wits end here.

Answer 1

Priv Auth Admin can not manage per user MFA by design:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-authentication-administrator

Answer 2

Hello @Todd Porter ,
Thank you for reaching out Microsoft Q&A.

I understand that you want to enable, disable, or enforce MFA for users, referred to as per-user MFA. You assigned the roles of Privileged Authentication Administrator and Authentication Administrator to users to change the status of per-user MFA (enable, disable, enforce). However, as stated in the documentation, Privileged Authentication Administrator cannot manage per-user MFA which was already said by Andy David - MVP in the above answer. Similarly, the Authentication Administrator role cannot manage per-user MFA (enable, disable, enforce) either. According to the document, this role can only manage MFA settings in the legacy MFA management portal, which is not managing per-user MFA. Refer to the image below for clarification.

I conducted a repro in my tenant and found that the Authentication Administrator role cannot manage per-user MFA (enable, disable, enforce). Instead, using the Authentication Policy Administrator as least privileged role allowed me to manage per-user MFA (enable, disable, enforce) successfully without any errors. for example, I tried to enable per-user-mfa for one of the user using Authentication Policy Administrator role and then when I check the per-user-mfa status of the user
still, it is in disabled state, but when I check with the per-user-mfa status with global admin the status is enabled.

NOTE: With Authentication Policy Administrator role, you can enable,disable,Enforce the per-user-mfa but cannot see the status of the user after as mentioned in above image.

To enable,disable,enforce the per-user-MFA you can follow: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates#change-the-status-for-a-user

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Regards,
Goutam Pratti.

Answer 3

You state that the Authentication Administrator however I have a team of 9 helpdesk each were given Authentication Administrator role granted via PIM near the beginning of this year and for months until last week they have each been able to manage per user MFA (Enable/Disable/Enforce). That is 10 MONTHS of it working flawlessly with the Legacy MFA portal. However now the UI of the per user mfa portal is changed and their ability to manage per user mfa gives a generic "Failed to Enabled Multifactor Authentication" Error.
What is needed to get this working again? Do I need to remove the Authentication Administrator role and grant them Authentication Policy Administrator role? According to this Auth Admin is still listed as the least privileged role that will allow per user mfa to work.
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#multifactor-authentication

What is needed to let them change the status and see the updated status of MFA? is the Legacy MFA portal still available?