Company wide MFA update: Howe to disable "phone number as username" prompt?

Posted by ADynes@reddit | sysadmin | View on Reddit | 21 comments

We are attempting to switch everyone over to a authenticator app (Microsoft or Google) form text based MFA and also add in conditional access rules, something we haven't done up to this point. So we are writing up instructions and as part of it everyone will go to [https://mysignins.microsoft.com/security-info](https://mysignins.microsoft.com/security-info) and make sure they have authenticator app as one of their options and if not adding it in. The problem is this banner at the top of the page: [https://imgur.com/a/CV8eTUQ](https://imgur.com/a/CV8eTUQ) We don't want any of our users using their phone numbers. Any idea how to disable this? I cannot find it anywhere and after two hours of searching nothing seems to understand what I'm talking about.

Reply to Post

21 Comments

[-]

AmazedSpoke@reddit

Is this for a personal Microsoft account? I've seen that on my personal account but not on my work account.

[-]

ADynes@reddit (OP)

No, on all our work accounts. Thats why I want it gone.

[-]

AmazedSpoke@reddit

Try removing their phone number from the account info.

[-]

ADynes@reddit (OP)

The one person that posted about unchecking the phone number thing was correct. We changed that setting and it's no longer listed at the top as an option which is exactly what we wanted. Didn't affect any MFA currently set up at the phone number.

[-]

cmorgasm@reddit

In Entra ID, Protection > Authentication Methods > Policies > SMS > unselect "Use for sign in"

[-]

ADynes@reddit (OP)

But what if 50% of our users currently use SMS? Won't that break it? I'm fine turning it off AFTER everyone has added authenticator apps.

[-]

cmorgasm@reddit

We had the same thought initially, and did a test group to figure out what would happen, so it shouldn’t break anything

[-]

ADynes@reddit (OP)

Thank-you! That did it.

[-]

sryan2k1@reddit

Please don't use "An authenticator" app, and use Microsoft auth with numbermatching only.

[-]

ADynes@reddit (OP)

Is there a technical reason for that? We will be supporting both Google and Microsoft. We have managed Google accounts and Google Authenticator backs up to those accounts. Microsoft authenticator forces users to use a personal account to back up to which we can't manage. Personally I don't even have Microsoft authenticator installed on my phone.

[-]

ThatsNASt@reddit

Authenticator by default does number matching. So it's phish resistant. It's a better option overall. I'm literally doing this same thing for a client rn.

[-]

ADynes@reddit (OP)

Well when Microsoft stops requiring a personal account for backup then we may change our mind but until then Google Authenticator makes more sense as we know it's being backed up. Not sure home many phones you lose but we have 100+ techs in the field and it's more often then we'd like.

[-]

sryan2k1@reddit

You can't backup work tokens anyway.

[-]

ADynes@reddit (OP)

You can with Google and since they are managed accounts we can restore access.

[-]

sryan2k1@reddit

And that's an absolute security nightmare.

[-]

ADynes@reddit (OP)

Please explain how when we have full access to the account and can disabled whenever we want to.

[-]

sryan2k1@reddit

Number matching is phish resistant and provides more data like sign in location and application, it's a much better and safer end user experience.

[-]

Thatzmister2u@reddit

You will have users who refuse to load a work app on their personal device even though they want work email on their personal device lol!!

[-]

ADynes@reddit (OP)

Yeah, we know. We are giving people that don't want to use their personal devices the option of Yubi Keys and we will hopefully enable conditional access to not require MFA from trusted (office) locations to help reduce the number of MFA requests. With that said out of 260 people we provide 210 cell phones so the remainder isn't much.

[-]

ThatBCHGuy@reddit

Following since I recently noticed this too.

[-]

vane1978@reddit

If you have the proper licensing you can create a Conditional Access policy to enforce your users to use a higher level of MFA options.