WE have configured DUO as our 2fa External authentication method in entra. When our o365 users login they are prompted to select DUO as an auth provider and are then are able to login to duo. Standard users work fine. Any user that is an office 365 admin is first prompted to use thems authenticator, they must then select "I can't use my Microsoft Authenticator app right now" to be given the option to use DUO as a 2fa provider which will work when selected. We have set the microsoft managed conditional access policy <a href="https://portal.azure.com/#blade/Microsoft_AAD_ConditionalAccess/MMContextPane.ReactView/policy/%7B%22id%22%3A%22c47f88b0-32e0-4610-8ad4-8a219d99ed69%22%2C%22displayName%22%3A%22Microsoft-managed%3A%20Multifactor%20authentication%20for%20admins%20accessing%20Microsoft%20Admin%20Portals%22%2C%22state%22%3A%22disabled%22%2C%22createdDateTime%22%3A%222023-12-04T21%3A49%3A45.4869096Z%22%2C%22templateId%22%3A%224200930c-0da2-4e33-ca01-000000000000%22%7D" rel="ugc nofollow">Multifactor authentication for admins accessing Microsoft Admin Portals to "off" and our admin users are covered by our active 2fa DUO conditional access policy so 2fa is effectively enabled for these users. How do we turn off the initial request to use MS authenticator when an o365 admin logs in . We have 2fa properly setup using EAM with DUO including for our tenant admin accounts.

Turn off MS authenticator for admin accounts - use alternate 2fa provider instead

Mike Cohen 0

WE have configured DUO as our 2fa External authentication method in entra. When our o365 users login they are prompted to select DUO as an auth provider and are then are able to login to duo. Standard users work fine.

Any user that is an office 365 admin is first prompted to use thems authenticator, they must then select "I can't use my Microsoft Authenticator app right now" to be given the option to use DUO as a 2fa provider which will work when selected.

We have set the microsoft managed conditional access policy

Multifactor authentication for admins accessing Microsoft Admin Portals

to "off" and our admin users are covered by our active 2fa DUO conditional access policy so 2fa is effectively enabled for these users.

How do we turn off the initial request to use MS authenticator when an o365 admin logs in . We have 2fa properly setup using EAM with DUO including for our tenant admin accounts.

Akhilesh 8,950 Reputation points Microsoft Vendor

2024-09-19T16:53:53.4333333+00:00

Hi @Mike Cohen

Thank you for reaching Microsoft Q&A forum!

If I understand correctly, you have configured the DUO for 2FA but when users sign in it is prompted and directed to Microsoft authenticator app not the DUO and you are selecting, I can't use my Microsoft Authenticator app right now" to be given the option to use DUO as a 2fa provider which works.

Since you have managed the conditional access policy, may I know have you create the custom controls for DUO MFA if yes have you select the RequireDUOMfa custom controls in the Access control baled of your conditional access policy?

For more information I suggest you go through the document and video Duo Two-Factor Authentication for Microsoft Entra ID (formerly Azure Active Directory)

Share via

Turn off MS authenticator for admin accounts - use alternate 2fa provider instead

Your answer