The settingWhat we hold this to
CreativeTechs minimum
Authentication Methods policy migration state = 'Migration Complete'. Zero users left with per-user MFA state Enabled or Enforced.
Benchmark position
Microsoft has deprecated per-user MFA in favour of Conditional Access. No competing figure.
Where we differ, and why
Order of operations, learned from our own tenant. Today it reads: 5 users on per-user MFA, 6 on CA MFA, Authentication methods policy in migrationInProgress, and Microsoft Authenticator DISABLED in that policy. Per-user MFA supersedes CA while both exist, which is why nobody has noticed. The safe sequence is: (1) enable Microsoft Authenticator and its number-matching settings in the Authentication methods policy — additive, no user impact; (2) confirm registration coverage there; (3) stand up the CA MFA policy in report-only, then enable it; (4) only then set per-user MFA to Disabled for all users; (5) mark migration Complete last. Marking migration Complete while Authenticator is disabled in the modern policy locks out every user who depends on it.
Where the switch is
Entra admin centre → Protection → Authentication methods → Manage migration. Per-user state lives at Entra → Users → Per-user MFA.
How to verify
Graph: /policies/authenticationMethodsPolicy → policyMigrationState eq 'migrationComplete'
- Why it matters
- Legacy per-user MFA can't be scoped, excluded or reported on, and it fights CA policies. Everything in Tier 2 assumes CA is the enforcement point.
- How we check
- Maester MT.1024.turnOffPerUserMFA.
- Fix — M365
- Stand up the CA MFA policy in report-only, confirm coverage, THEN disable per-user MFA for all users, then mark the Authentication methods migration complete. Order matters.
- Fix — Google
- No equivalent — GWS 2SV enforcement is already policy-based.
- User notices
- None if sequenced correctly. Sequenced wrong, you get double prompts or a lockout.
- Expected pushback
- None — invisible to users. But it is the riskiest ordering step in the baseline, and our own tenant is still on legacy per-user MFA.