You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/concept-registration-mfa-sspr-combined.md
+1-6Lines changed: 1 addition & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.reviewer: sahenry
15
15
16
16
ms.collection: M365-identity-device-management
17
17
---
18
-
# Combined security information registration (preview)
18
+
# Combined security information registration
19
19
20
20
Before combined registration, users registered authentication methods for Azure Multi-Factor Authentication and self-service password reset (SSPR) separately. People were confused that similar methods were used for Multi-Factor Authentication and SSPR but they had to register for both features. Now, with combined registration, users can register once and get the benefits of both Multi-Factor Authentication and SSPR.
21
21
@@ -25,11 +25,6 @@ Before enabling the new experience, review this administrator-focused documentat
25
25
26
26
Azure AD combined security information registration is not currently available to national clouds like Azure US Government, Azure Germany, or Azure China 21Vianet.
27
27
28
-
||
29
-
| --- |
30
-
| Combined security information registration for Multi-Factor Authentication and Azure Active Directory (Azure AD) self-service password reset is a public preview feature of Azure AD. For more information about previews, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).|
31
-
||
32
-
33
28
> [!IMPORTANT]
34
29
> Users who are enabled for both the original preview and the enhanced combined registration experience will see the new behavior. Users who are enabled for both experiences will see only the new My Profile experience. The new My Profile aligns with the look and feel of combined registration and provides a seamless experience for users. Users can see My Profile by going to [https://myprofile.microsoft.com](https://myprofile.microsoft.com).
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/howto-authentication-passwordless-phone.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,7 +38,7 @@ Instead of seeing a prompt for a password after entering a username, a person wh
38
38
39
39
### Enable the combined registration experience
40
40
41
-
Registration features for passwordless authentication methods rely on the combined registration preview. Follow the steps in the article [Enable combined security information registration (preview)](howto-registration-mfa-sspr-combined.md), to enable the combined registration preview.
41
+
Registration features for passwordless authentication methods rely on the combined registration feature. Follow the steps in the article [Enable combined security information registration](howto-registration-mfa-sspr-combined.md), to enable combined registration.
@@ -79,13 +79,13 @@ The admin can choose to enable the user to use passwordless phone sign-in, or th
79
79
80
80
### AD FS integration
81
81
82
-
When a user has enabled the Microsoft Authenticator passwordless credential, authentication for that user will always default to sending a notification for approval. This logic prevents users in a hybrid tenant from being directed to ADFS for sign-in verification without the user taking an additional step to click “Use your password instead.” This process will also bypass any on-premises Conditional Access policies, and Pass-through authentication flows.
82
+
When a user has enabled the Microsoft Authenticator passwordless credential, authentication for that user will always default to sending a notification for approval. This logic prevents users in a hybrid tenant from being directed to ADFS for sign-in verification without the user taking an additional step to click "Use your password instead." This process will also bypass any on-premises Conditional Access policies, and Pass-through authentication flows.
83
83
84
84
If a user has an unanswered passwordless phone sign-in verification pending and attempts to sign in again, the user may be taken to ADFS to enter a password instead.
85
85
86
86
### Azure MFA server
87
87
88
-
End users who are enabled for MFA through an organization’s on-premises Azure MFA server can still create and use a single passwordless phone sign in credential. If the user attempts to upgrade multiple installations (5+) of the Microsoft Authenticator with the credential, this change may result in an error.
88
+
End users who are enabled for MFA through an organization's on-premises Azure MFA server can still create and use a single passwordless phone sign in credential. If the user attempts to upgrade multiple installations (5+) of the Microsoft Authenticator with the credential, this change may result in an error.
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/howto-authentication-passwordless-security-key.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -45,7 +45,7 @@ Hybrid Azure AD joined devices must run Windows 10 Insider Build 18945 or newer.
45
45
46
46
### Enable the combined registration experience
47
47
48
-
Registration features for passwordless authentication methods rely on the combined registration preview. Follow the steps in the article [Enable combined security information registration (preview)](howto-registration-mfa-sspr-combined.md), to enable the combined registration preview.
48
+
Registration features for passwordless authentication methods rely on the combined registration feature. Follow the steps in the article [Enable combined security information registration (preview)](howto-registration-mfa-sspr-combined.md), to enable combined registration.
49
49
50
50
### Enable FIDO2 security key method
51
51
@@ -62,7 +62,7 @@ Registration features for passwordless authentication methods rely on the combin
62
62
1. Sign in if not already.
63
63
1. Click **Security Info**.
64
64
1. If the user already has at least one Azure Multi-Factor Authentication method registered, they can immediately register a FIDO2 security key.
65
-
1. If they don’t have at least one Azure Multi-Factor Authentication method registered, they must add one.
65
+
1. If they don't have at least one Azure Multi-Factor Authentication method registered, they must add one.
66
66
1. Add a FIDO2 Security key by clicking **Add method** and choosing **Security key**.
67
67
1. Choose **USB device** or **NFC device**.
68
68
1. Have your key ready and choose **Next**.
@@ -94,7 +94,7 @@ Administrator provisioning and de-provisioning of security keys is not available
94
94
95
95
### UPN changes
96
96
97
-
We are working on supporting a feature that allows UPN change on hybrid Azure AD joined and Azure AD joined devices. If a user’s UPN changes, you can no longer modify FIDO2 security keys to account for the change. The resolution is to reset the device and the user has to re-register.
97
+
We are working on supporting a feature that allows UPN change on hybrid Azure AD joined and Azure AD joined devices. If a user's UPN changes, you can no longer modify FIDO2 security keys to account for the change. The resolution is to reset the device and the user has to re-register.
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/howto-mfa-getstarted.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -134,7 +134,7 @@ A text message that contains a verification code is sent to the user, the user i
134
134
135
135
## Plan registration policy
136
136
137
-
Administrators must determine how users will register their methods. Organizations should [enable the new combined registration experience](howto-registration-mfa-sspr-combined.md) for Azure MFA and self-service password reset (SSPR). SSPR allows users to reset their password in a secure way using the same methods they use for multi-factor authentication. We recommend this combined registration, currently in public preview, because it’s a great experience for users, with the ability to register once for both services. Enabling the same methods for SSPR and Azure MFA will allow your users to be registered to use both features.
137
+
Administrators must determine how users will register their methods. Organizations should [enable the new combined registration experience](howto-registration-mfa-sspr-combined.md) for Azure MFA and self-service password reset (SSPR). SSPR allows users to reset their password in a secure way using the same methods they use for multi-factor authentication. We recommend this combined registrationbecause it's a great experience for users, with the ability to register once for both services. Enabling the same methods for SSPR and Azure MFA will allow your users to be registered to use both features.
138
138
139
139
### Registration with Identity Protection
140
140
@@ -272,7 +272,7 @@ If you have an NPS instance deployed and in use already, reference [Integrate yo
272
272
273
273
#### Prepare NPS for users that aren't enrolled for MFA
274
274
275
-
Choose what happens when users that aren’t enrolled with MFA try to authenticate. Use the registry setting `REQUIRE_USER_MATCH` in the registry path `HKLM\Software\Microsoft\AzureMFA` to control the feature behavior. This setting has a single configuration option.
275
+
Choose what happens when users that aren't enrolled with MFA try to authenticate. Use the registry setting `REQUIRE_USER_MATCH` in the registry path `HKLM\Software\Microsoft\AzureMFA` to control the feature behavior. This setting has a single configuration option.
276
276
277
277
| Key | Value | Default |
278
278
| --- | --- | --- |
@@ -333,7 +333,7 @@ Now that you have planned your solution, you can implement by following the step
333
333
1.[Combined MFA and SSPR](howto-registration-mfa-sspr-combined.md)
334
334
1. With [Identity Protection](../identity-protection/howto-mfa-policy.md)
335
335
1. Send user communications and get users to enroll at [https://aka.ms/mfasetup](https://aka.ms/mfasetup)
336
-
1.[Keep track of who’s enrolled](#identify-non-registered-users)
336
+
1.[Keep track of who's enrolled](#identify-non-registered-users)
337
337
338
338
> [!TIP]
339
339
> Government cloud users can enroll at [https://aka.ms/GovtMFASetup](https://aka.ms/GovtMFASetup)
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/howto-registration-mfa-sspr-combined-troubleshoot.md
+10-15Lines changed: 10 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Troubleshoot combined registration - Azure Active Directory
3
-
description: Troubleshoot Azure AD Multi-Factor Authentication and self-service password reset combined registration (preview)
3
+
description: Troubleshoot Azure AD Multi-Factor Authentication and self-service password reset combined registration
4
4
5
5
services: active-directory
6
6
ms.service: active-directory
@@ -15,15 +15,10 @@ ms.reviewer: sahenry
15
15
16
16
ms.collection: M365-identity-device-management
17
17
---
18
-
# Troubleshooting combined security information registration (preview)
18
+
# Troubleshooting combined security information registration
19
19
20
20
The information in this article is meant to guide admins who are troubleshooting issues reported by users of the combined registration experience.
21
21
22
-
||
23
-
| --- |
24
-
| Combined security information registration for Azure Multi-Factor Authentication and Azure Active Directory (Azure AD) self-service password reset is a public preview feature of Azure AD. For more information about previews, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).|
25
-
||
26
-
27
22
## Audit logs
28
23
29
24
The events logged for combined registration are in the Authentication Methods category in the Azure AD audit logs.
@@ -48,25 +43,25 @@ The following table lists all audit events generated by combined registration:
48
43
49
44
| Symptom | Troubleshooting steps |
50
45
| --- | --- |
51
-
| I’m not seeing the methods I expected to see. | 1. Check if the user has an Azure AD admin role. If yes, view the SSPR admin policy differences. <br> 2. Determine whether the user is being interrupted because of Multi-Factor Authentication registration enforcement or SSPR registration enforcement. See the [flowchart](../../active-directory/authentication/concept-registration-mfa-sspr-combined.md#combined-registration-modes) under "Combined registration modes" to determine which methods should be shown. <br> 3. Determine how recently the Multi-Factor Authentication or SSPR policy was changed. If the change was recent, it might take some time for the updated policy to propagate.|
46
+
| I'm not seeing the methods I expected to see. | 1. Check if the user has an Azure AD admin role. If yes, view the SSPR admin policy differences. <br> 2. Determine whether the user is being interrupted because of Multi-Factor Authentication registration enforcement or SSPR registration enforcement. See the [flowchart](../../active-directory/authentication/concept-registration-mfa-sspr-combined.md#combined-registration-modes) under "Combined registration modes" to determine which methods should be shown. <br> 3. Determine how recently the Multi-Factor Authentication or SSPR policy was changed. If the change was recent, it might take some time for the updated policy to propagate.|
52
47
53
48
## Troubleshooting manage mode
54
49
55
50
| Symptom | Troubleshooting steps |
56
51
| --- | --- |
57
-
| I don’t have the option to add a particular method. | 1. Determine whether the method is enabled for Multi-Factor Authentication or for SSPR. <br> 2. If the method is enabled, save the policies again and wait 1-2 hours before testing again. <br> 3. If the method is enabled, ensure that the user hasn’t already set up the maximum number of that method that they're allowed to set up.|
52
+
| I don't have the option to add a particular method. | 1. Determine whether the method is enabled for Multi-Factor Authentication or for SSPR. <br> 2. If the method is enabled, save the policies again and wait 1-2 hours before testing again. <br> 3. If the method is enabled, ensure that the user hasn't already set up the maximum number of that method that they're allowed to set up.|
58
53
59
54
## Disable combined registration
60
55
61
56
When a user registers a phone number and/or mobile app in the new combined experience, our service stamps a set of flags (StrongAuthenticationMethods) for those methods on that user. This functionality allows the user to perform Multi-Factor Authentication with those methods whenever Multi-Factor Authentication is required.
62
57
63
58
If an admin enables the preview, users register through the new experience, and then the admin disables the preview, users might unknowingly be registered for Multi-Factor Authentication also.
64
59
65
-
If a user who has completed combined registration goes to the current self-service password reset (SSPR) registration page at [https://aka.ms/ssprsetup](https://aka.ms/ssprsetup), the user will be prompted to perform Multi-Factor Authentication before they can access that page. This step is expected from a technical standpoint, but it's new for users who were previously registered for SSPR only. Though this extra step does improve the user’s security posture by providing another level of security, admins might want to roll back their users so that they're no longer able to perform Multi-Factor Authentication.
60
+
If a user who has completed combined registration goes to the current self-service password reset (SSPR) registration page at [https://aka.ms/ssprsetup](https://aka.ms/ssprsetup), the user will be prompted to perform Multi-Factor Authentication before they can access that page. This step is expected from a technical standpoint, but it's new for users who were previously registered for SSPR only. Though this extra step does improve the user's security posture by providing another level of security, admins might want to roll back their users so that they're no longer able to perform Multi-Factor Authentication.
66
61
67
62
### How to roll back users
68
63
69
-
If you, as an admin, want to reset a user's Multi-Factor Authentication settings, you can use the PowerShell script provided in the next section. The script will clear the StrongAuthenticationMethods property for a user’s mobile app and/or phone number. If you run this script for your users, they'll need to re-register for Multi-Factor Authentication if they need it. We recommend testing rollback with one or two users before rolling back all affected users.
64
+
If you, as an admin, want to reset a user's Multi-Factor Authentication settings, you can use the PowerShell script provided in the next section. The script will clear the StrongAuthenticationMethods property for a user's mobile app and/or phone number. If you run this script for your users, they'll need to re-register for Multi-Factor Authentication if they need it. We recommend testing rollback with one or two users before rolling back all affected users.
70
65
71
66
The steps that follow will help you roll back a user or group of users.
72
67
@@ -147,16 +142,16 @@ In a PowerShell window, run the following command, providing the script and user
147
142
148
143
`<script location> -path <user file location>`
149
144
150
-
### Disable the preview experience
145
+
### Disable the updated experience
151
146
152
-
To disable the preview experience for your users, complete these steps:
147
+
To disable the updated experience for your users, complete these steps:
153
148
154
149
1. Sign in to the Azure portal as a user administrator.
155
150
2. Go to **Azure Active Directory** > **User settings** > **Manage settings for access panel preview features**.
156
151
3. Under **Users can use preview features for registering and managing security info**, set the selector to **None**, and then select **Save**.
157
152
158
-
Users will no longer be prompted to register by using the preview experience.
153
+
Users will no longer be prompted to register by using the updated experience.
159
154
160
155
## Next steps
161
156
162
-
*[Learn more about the public preview of combined registration for self-service password reset and Azure Multi-Factor Authentication](concept-registration-mfa-sspr-combined.md)
157
+
*[Learn more about combined registration for self-service password reset and Azure Multi-Factor Authentication](concept-registration-mfa-sspr-combined.md)
0 commit comments