Microsoft Authenticator Being Forced Instead of our External Authentication Method

Question

I am trying to implement a new MFA conditional access policy that will meet Microsoft's requirements. I have successfully set up a new testing policy that does require MFA. We use an external authentication method, Cisco Duo. Whenever I go to test out the new CA policy, I am asked to use Microsoft authenticator first and I have to click multiple buttons to chose that I would rather use Cisco Duo to authenticate. I have tried excluding myself from Microsoft Authenticator under Authentication Methods on Entra ID. This does not work as every time I try to log on it ask me to create a new Microsoft Authenticator account. I then made sure the Microsoft enrollment campaign was disabled and it appears to be disabled and it still wants me to create a Microsoft Authenticator account. I do not want to fully disable Microsoft authenticator as there are a few users who do use the app. Basically, I am wondering if there is a way to prioritize Cisco Duo over the Microsoft Authenticator app whenever it comes to MFA.

Answer 1

Hi @Lucas W
Thank you for posting your query on Microsoft Q&A.

I understand that you are trying to prioritize Cisco Duo over the Microsoft Authenticator app whenever it comes to MFA.

Try to create a conditional access policy in which select the targeted users for whom you want to prioritize Cisco Duo over the Microsoft Authenticator app.

Under grant access select Require Multifactor Authentication>Require DuoMFA.

Then when the user login he is prompted for Cisco Duo MFA.

Hope this helps. Do let us know if you have any further queries.

---

If this answers your query, do click `Accept Answer` and `Yes`.

Thanks,

B. Siri Chandana.