Question

Contoso has enabled self-service password reset (SSPR) for all users, but many employees still authenticate using only SMS and office phone methods. Security wants to nudge users toward the more secure Microsoft Authenticator app (push and passwordless) without forcing an immediate registration interruption at their next sign-in. Users should be prompted during interactive sign-in to set up Authenticator, but must retain the ability to postpone (snooze) the prompt for a limited number of days. Which Entra ID capability should you configure to meet this requirement?

Accepted Answer

Configure a registration campaign in the Authentication methods policy to prompt users to set up Microsoft Authenticator during sign-in, with snooze allowed.

Answer

Create a Conditional Access policy requiring authentication strength that mandates Authenticator before granting access.

Answer

Enable the combined security information registration setting and set SSPR to require two methods.

Answer

Use an Identity Protection user risk policy that forces secure registration on risky sign-ins.