MFA block - unblock

Question

Hello AAD Gurus!

I've been trying to find an answer to this, but can't seem to get the right information. Is there a way to unblock MFA for a user account without having to go through the global admin? We want to delegate this option to the helpdesk, we tried resetting the password via our on-prem AD and it didn't seem to work, unless i'm wrong about that?

I also looked at this article, but maybe it doesn't apply
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-remediate-unblock

Thanks in advance for any tips

Answer 1

@Luc Tran
Thank you for your post!

If you're requiring MFA via Conditional Access Policy, you can reset/require re-registration for a users MFA settings, via the Azure Portal or PowerShell. As of right now, you can do this either with Global Admin permissions, Authentication Admin permissions (only works on non-admin users), or Privileged Authentication Administrator (can manage all users to include global admin).

When you mention "unblock" if you're referring to unblocking a user within AzureAD MFA settings under the Security tab, our documentation mentions that an Admin can unblock the user's account. Using our roles and permissions documentation, I'd recommend testing this option out with either the Authentication admin or Privileged Authentication Admin to see if this feature works with those two roles.

Require re-require MFA: Reset-MsolStrongAuthenticationMethodByUpn

Connect-MsolService -AzureEnvironment AzureCloud  
$User = Get-MSolUser -UserPrincipalName "******@company.onmicrosoft.com"  
$User.StrongAuthenticationMethods  
Reset-MsolStrongAuthenticationMethodByUpn -UserPrincipalName "******@company.onmicrosoft.com"  

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

Can We have a custom Role that ONLY Unblocks/Blocks users MFA?
We want to delegate this task to our HelpDesk without giving them the other permissions that come with the Privilege Auth Admin or other roles.

Answer 3

I found this link that may help some people. Looks like Authentication Policy Administrator should do it.

https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/active-directory/roles/delegate-by-task.md

Answer 4

Thanks so much for following up John and thank you for the suggestions.

Answer 5

Hey James,

I think MS finally released a role for MFA access, but it's actually causing my admin some issues, it almost looks as if it's a read only mode, can't upload/import or delete tokens or activate them. Not sure if you have some suggestions for that.

thanks!