Require Re-Register MFA is grayed out for Authentication Administrators

Question

Similar to this github issue: https://github.com/MicrosoftDocs/azure-docs/issues/60576

Our registered Authentication Administrators are not able to request re-register MFA for users. They used to be able to.
Our Global Administrators are able to use this feature.

Please advise which role should be assigned for Require Re-Register MFA.

Answer 1

@Anonymous
Thank you for your post!

I tested this out within my tenant and was able to re-require MFA with my user who is an Authentication Admin. I also found out that this doesn't work for all accounts, only users who are aren't in an admin role, as stated within the GitHub issue you mentioned. For more info.

If you'd like to re-require MFA for all users, including Global Admins, you'll need to use the Privileged Authenticator Administrator role.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

I encountered the same problem. The 'Authentication Administrator' role didn't allow re-registering MFA until I changed the assignment type from 'Eligible' to 'Active'.