Disabling mandatory MS Authenticator app

Question

Good afternoon,

We have text and call authentication set up as multi factor authentication for our users.

This has worked very well up until recently, when Microsoft have started to force the option of the authenticator app on users, and made it unskippable despite our setup.

The option to skip is not present on the "improve your sign ins" screen.

Where is the setting to disable the forcing of the authenticator app for the user?

I have seen on other posts there are options to disable this. For example here: https://learn.microsoft.com/en-us/answers/questions/1338546/users-are-being-forced-to-use-microsoft-authentica

If, as in the screenshot in the "accepted answer" post we change the registration campaign status to disabled, does this remove the enforced app prompt?

At present it is currently set to "Microsoft managed".

We are fine with the app as an OPTION however it should not be mandatory as it does exclude people who do not have the latest phones, or indeed, any smart phone.

Chris

Answer 1

It Seems that its very hard for Microsoft to understand the question at hand.

Let me simplify.

1: The Administrator DOES want to enforce MFA

BUT does not want to enforce Microsoft Authenticator.

Having MFA is important, but Microsoft deciding that all users should use Microsoft Auth as the standard is not correct.

Extra: how to exclude specific users from MFA in Microsoft 365?

Answer 2

The Authenticator Application has been a total disaster for me. I COUND NOT ACCESS MY OFFICE 365 ACCOUNT UNTIL I INSTALLED THIS APP. I still cannot use any Office 365 application from one of my laptops. It is completely locked out. This is a machine that I have used with Office 365 for years. It is now useless. I am talking to my attorney and will ask them to compose a complaint to the BBB (one of many, many complaints on the way). You cannot block access to an account that you are paying for and use every day in your business. This day was a total disaster.

I, unfortunately have two Office 365 accounts. I really don't have time to deal with a total loss of software and Office 365 accounts that go down due to this nonsense. It's enough that I cannot email clients with gmail accounts from Office 365 account. Do we really need to pile this disaster on top?

Not being able to tell the difference between a malware attack and an update is a major problem. What in God's name is Microsoft thinking?

Answer 3

It's more then just this it seems. Why they are forcing their second rate authenticator is beyond me but it's annoying. In Entra (old Azure) at https://entra.microsoft.com/ :

Protection -> Authentication Methods -> Settings -> System-preferred multifactor authentication: Disabled

Protection -> Authentication Methods -> Registration Campaign: Edit then Disabled and Save

Protection -> Authentication Methods -> Policies: Click Microsoft Authenticator and switch it to Disabled (if you want) then go to the others you do want and make sure they are enabled for all users (or whatever users you want). We have SMS, Voice Call, and Email OTP personally.

Answer 4

Clearly, Microsoft STILL doesn't understand your very simple question. The way I read this response is that they don't want to admit it's all or nothing. Either disable the authenticator or it will be required by Microsoft (probably due to someone's Draconian view of security... thanks, dude).

Answer 5

The question has been misread - we do not want to disable the thing entirely, just the forcing of it onto users!!!

At present our users are not allowed to opt out from the app download. Previously the app was an option rather than mandatory.