Admin permission for MFA

Question

Admin permission for MFA

lalajee 1,821

Hi, What group user needs to be in, to Access Azure MFA configuration

I need to give a it admin full rights to setup and configure MFA

https://portal.azure.com/#blade/Microsoft_AAD_IAM/MultifactorAuthenticationMenuBlade/GettingStarted

What group user need to be added in.

Tebogo Leshotho 0 Reputation points

2023-06-30T13:32:25.73+00:00

Name: Authentication Administrator

Description: Users with this role can set or reset any authentication method (including passwords) for non-administrators and some roles. Authentication Administrators can require users who are non-administrators or assigned to some roles to re-register against existing non-password credentials (for example, multifactor authentication or FIDO), and can also revoke remember multifactor authentication on the device, which prompts for MFA on the next sign-in.
Nidhi Patel 0 Reputation points

2024-07-02T18:50:48.99+00:00

I have given user authentication administrator but still not working for uploading CSV for Oauth. is there anything else has to be done??
Albert Alvarez 0 Reputation points

2024-12-18T15:10:45.2433333+00:00

Did you find a solution? We had this setting for over a year and now our admins in this role can no longer enable MFA for a new user.

Accepted answer

2 additional answers

Your answer

Tebogo Leshotho 0 Reputation points

2023-06-30T13:32:25.73+00:00

Name: Authentication Administrator

Description: Users with this role can set or reset any authentication method (including passwords) for non-administrators and some roles. Authentication Administrators can require users who are non-administrators or assigned to some roles to re-register against existing non-password credentials (for example, multifactor authentication or FIDO), and can also revoke remember multifactor authentication on the device, which prompts for MFA on the next sign-in.
Nidhi Patel 0 Reputation points

2024-07-02T18:50:48.99+00:00

I have given user authentication administrator but still not working for uploading CSV for Oauth. is there anything else has to be done??
Albert Alvarez 0 Reputation points

2024-12-18T15:10:45.2433333+00:00

Did you find a solution? We had this setting for over a year and now our admins in this role can no longer enable MFA for a new user.

Answer 1

AmanpreetSingh-MSFT 56,871 Moderator

Hi @lalajee

If you want to configure MFA for non-admin users only use Authentication Administrator role and if you want to configure MFA for all users including admin users, use Privileged Authentication Administrator role. You can read more information about these roles in the document shared by michev.

Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.

Ranjith KR 11 Reputation points

2023-01-06T11:51:31.143+00:00

MFA not working with Privilaged authentication administrator and Authentication administrator also. It only works with Global administrator.

Answer 2

Ranjith KR 11

MFA works with Authentication Policy administrator role.

Tebogo Leshotho 0 Reputation points

2023-06-30T13:26:39.9333333+00:00

You need to use the below

Name: Authentication Administrator

Description: Users with this role can set or reset any authentication method (including passwords) for non-administrators and some roles. Authentication Administrators can require users who are non-administrators or assigned to some roles to re-register against existing non-password credentials (for example, multifactor authentication or FIDO), and can also revoke remember multifactor authentication on the device, which prompts for MFA on the next sign-in.

Answer 3

Vasil Michev 119.6K MVP Volunteer Moderator

Use this article whenever you have questions about which admin role you should use: https://learn.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles

Share via

Admin permission for MFA

2 additional answers

Your answer