Enforcing phone number in azure active directory MFA

user_389222 0
Viewed 2738

I have an Azure Active Directory instance where I enabled MFA using Text Messages.

I tried logging-in using a user that has a phone number set in their profile, and was prompted with a dialog containing the user's phone number.

The problem is that this dialog enables the user to edit this number, instead for forcing them to use the one configured in the profile.

How can I make this dialog just use the user's phone number?

EDIT: This is the configuration in the authentication section: enter image description here

Login process: (notice how the phone number can be changed) enter image description here

multi-factor-authentication azure-active-directory azure
2 Answers

Based on my research. Firstly, Go to MFA-> Additional cloud-based MFA settings set up MFA verification options to use "Text message to phone"

enter image description here

Now, select the users tab and set the MFA to enabled for the user. enter image description here

Also avoid MFA from CA policies on the user as it was already set as MFA (mentioned above) to avoid conflict.

You need to configure the users settings to use particular phone number such that it will not prompt users with a dialog saying "Your organization needs more information to keep your account secure" to update phone number.

  1. Go to Azure Active Directory > Users > All users.
  2. Choose the user you wish to perform an action on and select Authentication methods then add the phone number and save. enter image description here
  3. In case we are using alternate phone number then Azure AD will ask us to enable to uses default phone number as below image. enter image description here
user_40183040

This can be done using PowerShell (taken from here)

Install-Module -NameMSOnline
Connect-MsolService 
$UserPrincipalName = "j.brown@exchangelabs.nl"
$SMS = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationMethod
$SMS.IsDefault = $true
$SMS.MethodType = "OneWaySMS"
$Phone = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationMethod
$Phone.IsDefault = $false
$Phone.MethodType = "TwoWayVoiceMobile"
$PrePopulate = @($SMS, $Phone)
Set-MsolUser -UserPrincipalName $UserPrincipalName -StrongAuthenticationMethods $PrePopulate

I am still not sure how to make it the default for all users.

user_3892220
Related