Azure MFA Custom Role: Unblock MFA for Users

Question

Azure MFA Custom Role: Unblock MFA for Users

Tein Mac 41

How can a custom role be created for Azure MFA where the Admin will ONLY have permission to Unblock MFA for Users as their SOLE role without having the other permissions that come out of the box with "Privileged Authentication Administrator" role ?

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Vasil Michev 125.2K MVP Volunteer Moderator

You cannot, not currently. Custom RBAC controls for Azure AD only supports certain actions, MFA reset is not one of them. For the time being, you need to use one of the built-in roles.

Tein Mac 41 Reputation points

2022-08-03T02:43:51.737+00:00
Thank you @Vasil Michev . We will be hopeful that in future MS will go granular on roles related to IAM Authentication.

Please which of these roles can perform the MFA Unblock/Block with least privileges?

Authentication Administrator

Privileged Authentication Administrator

Authentication Policy Administrator
Vasil Michev 125.2K Reputation points MVP Volunteer Moderator

2022-08-03T07:29:35.81+00:00

They will add more roles in the future, it just takes time. For the time being, here's the list of least privileged role by task: https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task#multi-factor-authentication
Stephen.G.Fisher 0 Reputation points

2023-02-14T18:20:31.37+00:00

Any idea when we may have a suitable role to unblock MFA, cannot see it on the roadmap and MS Support have pointed me to this article.

The only roles which appear to work are GA or Authentication Policy Administration which has the description of "This role is intended for managing policy rather than managing users"

Could ideally do with it wrapping up into one of the Security Roles so a SOC team can action upon a user reporting a fraud alert for example in the authenticator app causing their account to become blocked.

Does anyone know of any other roles which can unblock MFA as neither of the above are suitable for mass use?
Ali Sait ÇİÇEK 0 Reputation points

2023-04-17T15:23:28.82+00:00

Hi everyone, Is there any update on this topic or we still have to use one of the built-in roles. Thanks, Ali
Annett Janißek 0 Reputation points

2023-04-28T08:23:04.7766667+00:00

https://feedback.azure.com/d365community/idea/ed6b3dab-b825-ec11-b6e6-000d3a4f0789
Ed L 0 Reputation points

2025-02-14T00:32:11.0033333+00:00

Authentication Policy Administrator has access to block/unblock MFA user.
Ed L 0 Reputation points

2025-02-14T00:33:44.8133333+00:00

Authentication Policy Administrator has access to block/unblock MFA user.

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#multi-factor-authentication

Share via

Azure MFA Custom Role: Unblock MFA for Users

0 additional answers

Your answer