Hi All, I have migrated Authentication methods I have enabled Microsoft Authenticator for All users with Authentication mode set to Any. (plus Third -party software OATH tokens for All users and FIDO2 for selected group) I've created group to start targeted Registration campaign with few members that are not yet registered with MFA. I've also Enabled Registration campaign targeting above group. It's been couple of days now and none of the group members have been "nudged" so far by MFA Registration campaign. I've read others posts that apparently there is some glitch in MFA Registration campaign after migrating Authentication methods - but posts are like 6-8 months old. What else can I do to trigger the "nudge" for users so they can get registered? Any help appreciated.

Hi @PT Maliborski Thank you for reaching out to the community forum! Could you please confirm below. Have you Enable the registration campaign policy? If you have Conditional Access policies, please review Conditional Access Policies and check the targeted users is restricted to MFA. If the users in the targeted group have already registered for MFA it will not prompt to register again. Hope this helps. Do let us know if you any further queries. Thanks, Akhilesh. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

MFA Registration campaign - with "nudge" - after migrated Authentication methods

Accepted answer

Akhilesh 5,015 Reputation points Microsoft Vendor

2024-04-24T12:32:18.9033333+00:00

Hi @PT Maliborski

Thank you for reaching out to the community forum!

Could you please confirm below.

Have you Enable the registration campaign policy?

If you have Conditional Access policies, please review Conditional Access Policies and check the targeted users is restricted to MFA.

If the users in the targeted group have already registered for MFA it will not prompt to register again.

Hope this helps. Do let us know if you any further queries.

Thanks,

Akhilesh.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Please sign in to rate this answer.

1 person found this answer helpful.
PT Maliborski 246 Reputation points

2024-04-24T13:41:51.36+00:00

Hi Akhilesh,

Thank you for your answer.

Regarding your questions:

Have you Enable the registration campaign policy? - YES

If the users in the targeted group have already registered for MFA it will not prompt to register again. - that is clear from instructions. Users have no MFA setup.

If you have Conditional Access policies, please review Conditional Access Policies and check the targeted users is restricted to MFA. - we have Conditional Access policies targeting Admins, Guests and devices but not these users. What do you mean "check the targeted users is restricted to MFA."?

I thought that enabling MFA Registration Campaign will trigger the "nudge" for users regardless whether there is any Conditional Access policy targeting them or not.

Should I create CA targeting these users ie. for All apps, without any exceptions? I know this will trigger MFA (and by this registration) but I was hoping to register them without forcing CA

Akhilesh 5,015 Reputation points Microsoft Vendor

2024-04-29T10:23:44.43+00:00

Hi @PT Maliborski

As you said, "I thought that enabling MFA Registration Campaign will trigger the "nudge" for users regardless whether there is any Conditional Access policy targeting them or not." No, registration campaign will not push the registration prompt to end user if there is no enforce of MFA to them. This will targeted campaigns to move users from less secure authentication methods to Authenticator.

If you are looking for MFA registration prompt without enforcing them via CA policy or security defaults or per-user MFA. You can achieve this with Multifactor authentication registration policy from Identity protection. Please follow the below document to enable policy. https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy#policy-configuration

Outcome: User's will prompted to register with MFA and they'll have 14 days to complete registration. During this 14-day period, they can bypass registration if MFA isn't required as a condition, but at the end of the period they're required to register before they can complete the sign-in process.

Akhilesh 5,015 Reputation points Microsoft Vendor

2024-05-02T07:13:29.85+00:00

@PT Maliborski
Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

PT Maliborski 246 Reputation points

2024-05-02T08:33:40.0333333+00:00

Akhilesh,Thank you for your advice.

I have enabled Multifactor authenticator registration policy and now all seems to be working. "Nudge" was shows to my test account and other registered user.

Thank you for your support
Sign in to comment

MFA Registration campaign - with "nudge" - after migrated Authentication methods

0 additional answers