Description
The Authentication methods policy is the only place that decides which methods users can register and use: its Manage migration state is Migration Complete. The legacy per-user MFA service settings (verification options) and the legacy SSPR methods are then ignored.
Every method that users still need is enabled in the Authentication methods policy before the switch, and the other controls of this standard on methods (SMS, Voice call, Email OTP, Software OATH tokens, Passkey (FIDO2), Temporary Access Pass) are set there.
Rationale
During migration, Entra ID honours the union of the legacy policies and the new one. A weak method disabled in the new policy, such as SMS, stays usable if the legacy MFA or SSPR policy still allows it. Microsoft stopped managing methods in the legacy policies on 30 September 2025; finishing the migration removes the ambiguity.
Impact
Users lose any method that was only allowed by the legacy policies. Compare both sides first, or run the automated migration guide, which copies the legacy settings into the new policy. Security questions for SSPR stay in the legacy SSPR policy.
Setting
| Location | Microsoft Entra admin center > Entra ID > Authentication methods > Policies > Manage migration |
| Default | Pre-migration on older tenants |
| Recommended | Migration Complete |
Audit
- Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
- Browse to Entra ID > Authentication methods > Policies.
- Read the migration banner or select Manage migration to see the current state.
- Read-only alternative with Microsoft Graph PowerShell (scope
Policy.Read.All):(Get-MgPolicyAuthenticationMethodPolicy).PolicyMigrationState(Graph:GET https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy). - Fail if the state is not Migration Complete (
migrationComplete).
Remediation
- Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
- Record the legacy settings: Entra ID > Users > Per-user MFA > service settings (verification options) and Entra ID > Password reset > Authentication methods.
- Browse to Entra ID > Authentication methods > Policies and either run the automated migration guide, or enable by hand each method still needed, for the right groups.
- Select Manage migration > Migration in progress, check sign-ins and password resets
for a few days, then select Migration Complete and save.
Graph equivalent:
PATCH /policies/authenticationMethodsPolicywith"policyMigrationState": "migrationComplete".
Rollback
Set Manage migration back to Migration in progress; the legacy policies apply again.
References
- How to migrate MFA and SSPR policy settings to the Authentication methods policy Microsoft, vendor-doc, accessed 2026-10-24
- Manage authentication methods for Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24
- CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | IA-5 | related |
| NIST SP 800-53 Rev. 55.1.1 | CM-6 | related |
| CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0 | MS.AAD.3.4v1 | equivalent |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Related controls
- related
CB-M365-AUTH-007Disable one-time passcodes in Microsoft Authenticator - related
CB-M365-AUTH-010Disable per-user MFA for every user - related
CB-M365-AUTH-011Disable SMS and voice call as authentication methods - related
CB-M365-AUTH-039Enable self-service password reset for all users
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
