Zum Inhalt

System-preferred MFA methods

Enable the most secure MFA method which is registered by the User, may more methods are available but not yet configured:

System-preferred multifactor authentication (MFA) prompts users to sign in by using the most secure method they registered. Administrators can enable system-preferred MFA to improve sign-in security and reduce less secure sign-in methods like Short Message Service (SMS). Users don't need to set any authentication method as their default because the system always chooses and presents the most secure method they registered.

Default Ordner

When enabled, MFA methods are prioritized in the following order (system-preferred):

  1. Temporary Access Pass (TAP)
  2. Passkey (FIDO2)
  3. Certificate-based authentication (CAB)
  4. External authentication methods [Preview]
  5. Microsoft Authenticator notifications (Microsoft Auth App)
  6. Time-based one-time password (TOTP) (Third Party Auth App)
  7. Telephony (SMS and Voice)

Prerequisite - Authentication methods

Before enabling system-preferred MFA, review which authentication methods are currently available in your environment.

Prioritize enabling secure methods from the stronger side of the method comparison table: alt text

If secure methods are not yet enabled for users, the above order will not improve your security posture. alt text

Handling Downgrades - Authentication Methods

In some scenarios, users may be unable to use the most secure method (for example, Passkey in a virtual environment) or may require SMS for a specific application. In such cases, you have two options:

Configure a custom Authentication Strength combination and apply it with Conditional Access to your scenario:

alt text

Option 2 - Adjust Authentication methods Target

Modify the scope of Authentication methods and include or exclude a specific Group from the Target:

alt text

Note

Keep in mind that the user is not able to register a stronger method, when this is actively prevented, so this should be reviewed periodically to avoid limiting future improvements.

Enable - System-preferred MFA

The setting is in most tenants already enabled in the "Microsoft managed" or "Enabled" state, but always worth verifying:

Summary

I personally hope you have learned one or two things even if the feature may already was enabled in your tenant. System-preferred MFA simplifies the user experience and strengthens your organization’s sign-in security.

Wishing you a secure and productive week ahead!

Reference:

Kommentare