Migrating Legacy MFA & SSPR to Authentication Methods Policy for Microsoft Entra ID

You can migrate Microsoft Entra ID legacy policy settings that separately control multifactor authentication and self-service password reset (SSPR) to unified management with the Authentication methods policy.

You migrate policy settings on your own schedule, and the process is fully reversible. You can continue to use tenant-wide MFA and SSPR policies while you configure authentication methods more precisely for users and groups in the Authentication methods policy. You complete the migration whenever you're ready to manage all authentication methods together in the Authentication methods policy.

If the migration didnt succeed after you disable the legacy authentication methods options,
you can try to disable " Allow users to create app passwords to sign in to non-browser apps" in MFA configuration,
and put as do not allow temporary

[saiabhilash]

Thank you so much sir . I was struggling to understand this concept .You made it so simple .Thanks so much

[hachadwick]

much more clear than the MS docs...thank you!

[arseni.paharelau]

Thank you! The migration only took me 5 minutes!

[hayenchinguyen]

Sir, I want to ask that before the migration, I need to enable the CAP and modern authentication methods + disable verification methods in service-settings and SSPR options, but do I also need to disable the "enforced" per-user MFA as well?

[gregchin]

My tenant says I need a license for Multi Factor Authentication. What is the difference between that and using Microsoft Authenticator.

[reginaldomoreno]

One more question, Could I back to "migration in progress" if anything is wrong after changed to "migration completed"?

[LV]

Thank you for the informative guide.

Currently, in my organization, MFA is enabled only for specific privileged accounts, while the vast majority do not have it enabled.
Additionally, SSPR is disabled (never was enabled)

If I do this migration from legacy MFA to the Authentication Methods policy, will it impact users who do not currently have MFA enabled? Moreover, will this migration mandate/enforce MFA for users who currently do not use it?

[reginaldomoreno]

Thanks for your presentation. It's fine. Could you answer one thing? How will automatic password reset work after migration?

[andrewenglish]

what about existing users who are on MFA using the app do they need to re-authenticate with Microsoft?