Allow support users to enable MFA for

Tom CX 1 Reputation point
2021-03-22T10:34:48.95+00:00

Hello,

I have a few colleagues working on the help desk. These must be given the rights to enable MFA in AAD for new accounts but also existing accounts. As far as I can see I need to make them Azure Global Admin. Of course I don't want that. The fewer rights someone has, the better.

I add the colleguas of the supportdesk to the "Privileged Authentication Administrator". But then still can't access this page ( https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx ) to enable MFA.

I hope you can help me.

Tom

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,417 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. AmanpreetSingh-MSFT 56,301 Reputation points
    2021-03-22T11:09:28.713+00:00

    Hi @Tom CX · Thank you for reaching out.

    To allow help desk users to enable per user MFA via Multi-factor Authentication Portal, you need to assign both directory roles mentioned below:

    • Authentication Policy Administrator: This role will allow access to Multi-factor Authentication Portal but won't allow enabling/disabling per-user MFA.
    • Privileged Authentication Administrator: This role allows enabling/disabling per-user MFA.

    -----------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    2 people found this answer helpful.
  2. Frank Smith 0 Reputation points
    2023-04-13T17:13:44.0333333+00:00

    Per AmanpreetSingh's post, I followed these steps: From AAD open All Users blade Searched for and selected user From the User's Profile page, I selected Assigned Roles From the Assigned Roles page, I clicked Add assignments and from the Directory Roles list selected both the Authentication Policy Administrator and the Privileged Authentication Administrator roles and clicked the Add button at the bottom. These steps allowed help desk team members who were previously unable to manage MFA for users immediately able to do so. There is an Authentication Administrator Role available, which won't work. Not sure if that might have been the problem for the OP or if something changed, but adding the roles as suggested by AmanpreetSingh worked.