How can a custom role be created for Azure MFA where the Admin will ONLY have permission to Unblock MFA for Users as their SOLE role without having the other permissions that come out of the box with "Privileged Authentication Administrator" role ?

You cannot, not currently. Custom RBAC controls for Azure AD only supports certain actions, MFA reset is not one of them. For the time being, you need to use one of the built-in roles.

Azure MFA Custom Role: Unblock MFA for Users

Accepted answer

Vasil Michev 109.5K Reputation points MVP

2022-07-29T05:49:56.883+00:00

You cannot, not currently. Custom RBAC controls for Azure AD only supports certain actions, MFA reset is not one of them. For the time being, you need to use one of the built-in roles.
Please sign in to rate this answer.
Tein Mac 36 Reputation points

2022-08-03T02:43:51.737+00:00

Thank you @Vasil Michev . We will be hopeful that in future MS will go granular on roles related to IAM Authentication.

Please which of these roles can perform the MFA Unblock/Block with least privileges?

Authentication Administrator

Privileged Authentication Administrator

Authentication Policy Administrator

Vasil Michev 109.5K Reputation points MVP

2022-08-03T07:29:35.81+00:00

They will add more roles in the future, it just takes time. For the time being, here's the list of least privileged role by task: https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task#multi-factor-authentication

Stephen.G.Fisher 0 Reputation points

2023-02-14T18:20:31.37+00:00

Any idea when we may have a suitable role to unblock MFA, cannot see it on the roadmap and MS Support have pointed me to this article.

The only roles which appear to work are GA or Authentication Policy Administration which has the description of "This role is intended for managing policy rather than managing users"

Could ideally do with it wrapping up into one of the Security Roles so a SOC team can action upon a user reporting a fraud alert for example in the authenticator app causing their account to become blocked.

Does anyone know of any other roles which can unblock MFA as neither of the above are suitable for mass use?

Ali Sait ÇİÇEK 0 Reputation points

2023-04-17T15:23:28.82+00:00

Hi everyone, Is there any update on this topic or we still have to use one of the built-in roles. Thanks, Ali

Annett Janißek 0 Reputation points

2023-04-28T08:23:04.7766667+00:00

https://feedback.azure.com/d365community/idea/ed6b3dab-b825-ec11-b6e6-000d3a4f0789
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure MFA Custom Role: Unblock MFA for Users

0 additional answers

Your answer