How to configure MFA to ask for 2 methods?

Carlos Fernandes 1 Reputation point


What options do I need to configure for MFA to ask new users to set up the Microsoft Authenticator app (alternatively any other app ) and an email address on the first login?
To be clear, I don't need 2 methods for SSPR, the App alone is fine but I want users to have the email method configured as an alternative in case they lose their phone.

It's a new tenancy so combined security is enabled, the Authenticator App method is configured for all users and conditional access is enabled and configured.

On the authentication methods I have 1 method required to reset, the "Mobile app notification" is greyed out (I assume because only 1 selected) + "Mobile app code" (in case they use another app + email. I may need to add phone because some people don't have smart phones.

Ideally, the App is the primary method and email secondary.

Thanks in advance,


Microsoft Authenticator
Microsoft Authenticator
A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation.
5,444 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,376 questions
{count} votes