Azure AD Users MFA Settings - Global Admins only ?

Question

Hi,

Am I right in believing that only GAs can modify MFA settings for users ?

I tried experimenting with some of the recently added roles, but still couldn't find one that gave the appropriate rights.

Thanks...

Answer 1

You can manage it automatically by enable conditional access policy.

https://learn.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#authentication-administrator

Please do not forget to "Accept the answer" and Upvote on the post that helps you, this can be beneficial to other community members.
http://www.moamenhany.com

Answer 2

Yup, global admins. Authentication admins can reset MFA details for regular, but not change them: https://learn.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#authentication-administrator
Privileged auth admins can do the same, for any user.

We should eventually get a role or API permission that allows this, but for the moment you need GA.

Answer 3

https://learn.microsoft.com/answers/answers/62315/view.html