Azure MFA best practices - Removing phone and text as an option

Question

We're looking to update and improve our MFA security settings for our Azure portal.

Objectives:

1. All Azure AD users can only login with MFA through A) Authenticator App and/or B) Yubikeys

Problem:

1. When registering a device to for MFA, azure asks for a phone number and without it you cannot progress in registering the device for MFA. Our issue with this is that SIMs are relatively easy to virtually duplicate and weaken MFA as a security feature. We want to make sure that each user can only access the azure portal using an Authenticator app and or a Yubikey.

Question:
How do we disable Azure asking for phone number as an authentication backup method? Without providing a phone number to text it won't let our users go forward with finalizing a device for MFA setup.

Potentially Important Information:
Our license type is: Azure AD Free

Answer 1

Hi @J S ,

Hopefully, this point you in the right direction.

https://learn.microsoft.com/en-us/answers/questions/751070/how-do-you-require-the-authenticator-app-in-azure.html

Answer 2

@J S
Thank you for your post!

When it comes to users being prompted to add a phone number, can you see if disabling the "Call to phone" and "Text message to phone" verification options help resolve your issue?

If the Per-User MFA settings don't resolve your issue, can you see if your Azure Tenant is registered for Combined Registration? If so, you should be able to set the combined security information registration experience feature to "None". For more info.

You can also check if your tenant is enabled for SSPR, since the phone number could be a required for SSPR purposes and not MFA.

When it comes to having multiple methods of authentication this should also prevent users from being accidentally locked out of your Azure Active Directory tenant due to the loss of a password, YubiKey, or access to their MS Authenticator.

Additional Links:
Unable to reset password and access authenticator app
Manage emergency access accounts in Azure AD
A user or an administrator forgot his or her password in Office 365, Azure, or Intune

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 3

Oh wow! Both of your answers were fantastic! Thanks so much to you both.

Answer 4

@JamesTran-MSFT

When removing the call option the users are getting a popup/snip with both options = SMS, and CALL.
Is it possible to remove the Call option (visually - cosmetic) in the snip? and leave only SMS?

I know it is a cosmetic option but it should be possible.