Migrating Off SMS with the Authentication Methods Policy

Lab Metadata

Core technologies

Scenario and Description

Your Lab 01 baseline gave Northgate's programme board an uncomfortable number: a meaningful share of staff complete MFA over SMS text messages, and some administrators have no strong method registered at all. SMS is the weakest widely deployed second factor. It is exposed to SIM-swap fraud, SS7 interception and simple social engineering of mobile carriers. Regulators and the National Cyber Security Centre have moved firmly toward app-based and phishing-resistant factors.

Since 30 September 2025, Microsoft retired the ability to manage authentication methods in the legacy per-user MFA and legacy SSPR blades. There is now one place that governs which factors exist and who can use them: the Authentication Methods policy. This is a good thing. It is a single, targetable, Graph-manageable control plane, and it is where the whole of this lab lives.

You will enable Microsoft Authenticator for the estate, switch on the Authenticator registration campaign so that SMS users are prompted to adopt the app at sign-in, scope the SMS method down to a controlled exception group rather than the whole tenant, then disable SMS once the exception group is empty. This is the exact "migration away from SMS-based authentication to Microsoft Authenticator" work named in the specialist brief, done safely and reversibly.

Prerequisites

Prior labs

Lab 01 is required. You need the seeded Northgate personas (asmith, jpatel, lokafor) and the baseline script, which you re-run at the end to measure the change. The tenant and P1/P2 licence set up in Lab 01 carry forward.

New Graph scope introduced

# From Lab 01 you already have PowerShell 7 and the Graph SDK.
Get-MgContext | Select-Object Account,TenantId

# Confirm the tenant has premium licensing (needed by later labs and the campaign):
(Get-MgSubscribedSku).ServicePlans |
  Where-Object { $_.ServicePlanName -match 'AAD_PREMIUM' } |
  Select-Object ServicePlanName,ProvisioningStatus -Unique

Real-World Problem Statement

You cannot retire SMS with a single switch without risking lockouts for users who have no other factor. A safe migration reduces reliance gradually, gives users a prompted path to a stronger method, keeps a controlled exception for genuine edge cases, and measures progress the whole way.

Concrete scenario: Northgate has 900 staff still registered for SMS, of whom around 200 have no app method. A hard cut-off would lock those 200 out on Monday morning. Your job is to move them across without a single preventable lockout, then close SMS behind them.

Skills Mapped to Production Solutions

Architecture Overview

Everything in this lab sits inside one object: the tenant's Authentication Methods policy. You edit three parts of it, the Microsoft Authenticator configuration, the SMS configuration, and the registration enforcement campaign, and you use one supporting group to hold the shrinking SMS exception list.

Data flow

1. You enable Microsoft Authenticator for all users, so a stronger factor is available to everyone.
2. The registration campaign intercepts SMS-only users at sign-in and prompts them to add the app.
3. As users register the app, you remove them from the SMS-Legacy-Allowed group.
4. When the group is empty, you set the SMS configuration state to disabled, retiring the weak factor.

Step-by-Step Implementation

Phase A - Audit the current policy

Connect-MgGraph -Scopes 'Policy.ReadWrite.AuthenticationMethod',
  'Group.ReadWrite.All','GroupMember.ReadWrite.All','User.Read.All' -NoWelcome

# List every method configuration and its current state.
Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration |
  Select-Object Id, State | Sort-Object Id | Format-Table -AutoSize

# Expected IDs include: MicrosoftAuthenticator, Sms, Fido2, Email,
# TemporaryAccessPass, SoftwareOath, Voice, X509Certificate.

Phase B - Enable Microsoft Authenticator for the estate

$authenticatorBody = @{
  '@odata.type' = '#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration'
  state = 'enabled'
  includeTargets = @(
    @{
      targetType = 'group'
      id = 'all_users'          # special built-in target meaning the whole tenant
      authenticationMode = 'any' # push or passwordless
    }
  )
  featureSettings = @{
    displayAppInformationRequiredState = @{
      state = 'enabled'
      includeTarget = @{ targetType = 'group'; id = 'all_users' }
    }
    displayLocationInformationRequiredState = @{
      state = 'enabled'
      includeTarget = @{ targetType = 'group'; id = 'all_users' }
    }
  }
}

Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
  -AuthenticationMethodConfigurationId 'MicrosoftAuthenticator' `
  -BodyParameter $authenticatorBody

(Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
  -AuthenticationMethodConfigurationId 'MicrosoftAuthenticator').State
# Expected: enabled

Phase C - Nudge SMS users onto the app

$campaignBody = @{
  registrationEnforcement = @{
    authenticationMethodsRegistrationCampaign = @{
      state = 'enabled'
      snoozeDurationInDays = 0
      includeTargets = @(
        @{
          id = 'all_users'
          targetType = 'group'
          targetedAuthenticationMethod = 'microsoftAuthenticator'
        }
      )
    }
  }
}

Update-MgPolicyAuthenticationMethodPolicy -BodyParameter $campaignBody

(Get-MgPolicyAuthenticationMethodPolicy).RegistrationEnforcement.AuthenticationMethodsRegistrationCampaign.State
# Expected: enabled

Phase D - Scope SMS down, then retire it

# 1. Create a security group to hold the shrinking SMS exception list.
$grp = New-MgGroup -DisplayName 'SMS-Legacy-Allowed' `
  -MailEnabled:$false -MailNickname 'sms-legacy-allowed' `
  -SecurityEnabled:$true

# 2. Seed it with users who still genuinely need SMS (here: asmith as an example).
$domain = (Get-MgOrganization).VerifiedDomains | Where-Object IsDefault | Select-Object -ExpandProperty Name
$asmith = Get-MgUser -Filter "userPrincipalName eq 'asmith@$domain'"
New-MgGroupMember -GroupId $grp.Id -DirectoryObjectId $asmith.Id

# 3. Re-target the SMS method from everyone to just this group.
$smsBody = @{
  '@odata.type' = '#microsoft.graph.smsAuthenticationMethodConfiguration'
  state = 'enabled'
  includeTargets = @(
    @{ targetType = 'group'; id = $grp.Id; isUsableForSignIn = $true }
  )
}
Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
  -AuthenticationMethodConfigurationId 'Sms' -BodyParameter $smsBody

(Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
  -AuthenticationMethodConfigurationId 'Sms').AdditionalProperties.includeTargets
# Expected: a single group target whose id matches $grp.Id, not all_users.

# As each user registers the app, remove them from the exception group.
Remove-MgGroupMemberByRef -GroupId $grp.Id -DirectoryObjectId $asmith.Id

# Check remaining members.
$remaining = Get-MgGroupMember -GroupId $grp.Id -All
"SMS exception members remaining: $($remaining.Count)"

# When the count is zero, disable SMS entirely.
if ($remaining.Count -eq 0) {
  Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
    -AuthenticationMethodConfigurationId 'Sms' `
    -BodyParameter @{ '@odata.type'='#microsoft.graph.smsAuthenticationMethodConfiguration'; state='disabled' }
  Write-Host 'SMS method disabled.' -ForegroundColor Green
}

Testing and Validation

1. Sign in as asmith in a private browser window at office.com. You should be prompted by the registration campaign to set up Microsoft Authenticator.
2. Complete the setup, approving a test prompt. Confirm the prompt shows the application name and location context you enabled in Phase B.
3. Re-run the Lab 01 baseline script. The SMS-reliant count should fall and asmith should now report IsMfaCapable = true with microsoftAuthenticatorPush among the registered methods.

Security Analysis

What makes this sound

• Availability before removal: the strong factor is enabled and adopted before the weak one is withdrawn, so no user is left without a method.
• Controlled exception: SMS survives only for a named, auditable group that trends to empty, not for the whole tenant indefinitely.
• Fatigue resistance: app and location context, on top of Microsoft-enforced number matching, defends against blind-approval attacks.

Intentionally simplified for the lab

• The migration timeline is compressed. Production runs the campaign for one to two weeks and watches the registration report before narrowing SMS.
• The exception group is drained manually. At scale you would drive membership dynamically or from a leavers and adoption report.

Production hardening

• Layer this with Conditional Access (Lab 03) so that even where a factor exists, MFA is actually required at sign-in.
• For high-value administrative accounts, move beyond the app to phishing-resistant FIDO2 keys (Lab 04). App push is strong, keys are stronger.
• Alert on any future re-enable of SMS at tenant scope as a change-management tripwire.

Cleanup Instructions

# Re-enable SMS for all users (undo the scoping).
Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
  -AuthenticationMethodConfigurationId 'Sms' `
  -BodyParameter @{ '@odata.type'='#microsoft.graph.smsAuthenticationMethodConfiguration'; state='enabled';
    includeTargets=@(@{ targetType='group'; id='all_users'; isUsableForSignIn=$true }) }

# Disable the registration campaign.
Update-MgPolicyAuthenticationMethodPolicy -BodyParameter @{
  registrationEnforcement=@{ authenticationMethodsRegistrationCampaign=@{ state='disabled' } } }

# Remove the exception group.
$g = Get-MgGroup -Filter "displayName eq 'SMS-Legacy-Allowed'"
if ($g) { Remove-MgGroup -GroupId $g.Id }
Disconnect-MgGraph

Recommended Learning Links

• Manage authentication methods (the converged policy)
• Authenticator registration campaign
• Number matching for Authenticator
• Graph API: authenticationMethodsPolicy resource
• SMS and telephony method considerations

Key Takeaways and Next Lab

• The Authentication Methods policy is now the single control plane for factors, the legacy per-user MFA and SSPR method management were retired in September 2025.
• Enable the strong factor and adopt it before removing the weak one. Order is the safety.
• A registration campaign migrates the population for you, a scoped exception group lets you retire SMS without lockouts.
• Re-baselining turns the migration into a measurable, board-ready number.