How can I perform bulk changes for the Microsoft Authenticator Apps registration?

Question

I have several thousands of users in my company that are still using SMS as the primary authentication methods without anything else.

How can I perform the bulk enroll or add the Microsoft Authenticator apps to the below user settings ?

Thank you in advance.

Answer 1

Hi EnterpriseArchitect,

Thank you for contacting Microsoft Support!

To push the Microsoft Authenticator app for bulk users, you can utilize the Registration campaign feature in Azure Active Directory.

To enable the registration campaign policy, you must use the Authentication Methods Policy using Graph APIs. Those assigned at least the Authentication Policy Administrator role can update the policy.

To configure the policy using Graph Explorer:

1. Sign in to Graph Explorer and ensure you've consented to the Policy.Read.All and Policy.ReadWrite.AuthenticationMethod permissions. To open the Permissions panel:
2. Retrieve the Authentication methods policy: JSONCopy

      GET https://graph.microsoft.com/v1.0/policies/authenticationmethodspolicy
   

3. Update the registrationEnforcement and authenticationMethodsRegistrationCampaign section of the policy to enable the nudge on a user or group. To update the policy, perform a PATCH on the Authentication Methods Policy with only the updated registrationEnforcement section: JSONCopy

      PATCH https://graph.microsoft.com/v1.0/policies/authenticationmethodspolicy
      
      
   

In addition to using the Graph Explorer, you can also enable the registration campaign policy using the Microsoft Entra admin center. Please refer to the article below for more details.

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-registration-campaign

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.