Question

Your organization currently manages MFA and passwordless settings across three separate places: the legacy per-user MFA settings, the SSPR authentication methods policy, and the modern Authentication methods policy in Microsoft Entra. Leadership wants a single, consolidated location for controlling which methods (such as Microsoft Authenticator, FIDO2 keys, and SMS) users can register and use for both sign-in and password reset. As the Microsoft 365 administrator, what should you do to consolidate management going forward?

Accepted Answer

Use the Authentication methods migration wizard to move to the converged Authentication methods policy, then manage all methods there.

Answer

Disable the Authentication methods policy and rely solely on the legacy per-user MFA service settings for all method control.

Answer

Configure each method only in the SSPR authentication methods policy, since it governs both sign-in and reset.

Answer

Create a Conditional Access policy that specifies exactly which authentication methods users may register.