What this check looks at
Checks that the move from the legacy MFA and self-service password reset policies to the authentication methods policy is marked complete, so the legacy settings no longer apply.
For years three places in Entra ID decided which sign-in methods people could use: the legacy MFA service settings (reached from the per-user MFA page), the self-service password reset authentication methods, and the newer authentication methods policy. Microsoft has moved method management to the authentication methods policy and is retiring the legacy settings. Manage migration records where a tenant stands: Pre-migration, Migration in progress, or Migration complete.
The check fails when the migration is not marked complete, saying whether it has not started or is in progress, and passes at Migration complete. Until then Entra combines the legacy and new policies, so a method allowed in either is allowed.
That combination is the problem: a method switched off in the authentication methods policy, such as text message or voice call, still works if the legacy MFA or password reset settings allow it. An administrator who believes text codes are off may have most of the tenant still using them, with all their weaknesses.
Why it matters
Until the migration is complete, methods turned off in the authentication methods policy can still be allowed by the old MFA and password reset pages, so a method thought to be off may still be in use.
A client decides to retire text codes after a SIM-swap scare, and the engineer turns SMS off in the authentication methods policy. Months later another account is taken over through a text code: the legacy MFA settings still allowed text messages, so the change never took effect. Completing the migration makes the authentication methods policy the single place where methods are on or off.
Waiting has a cost too. As Microsoft retires the legacy settings, tenants still relying on them meet surprises when defaults change. A tidy migration, done once, removes that risk and makes later method changes predictable.
The CISA SCuBA baseline (MS.AAD.3.4v1) asks for the authentication methods migration to be set to Migration complete. The rule maps to NIST CSF 2.0 PR.PS-01.
How to fix it
Where: Entra admin centre → Protection → Authentication methods → Policies
Before you start
- Compare the legacy MFA and SSPR method settings with the authentication methods policy, and turn on in the new policy any method people still use.
- Move SMS or voice users to Authenticator first if those methods are being retired.
Step by step
- Record the legacy MFA methods. In the Microsoft Entra admin centre, go to Entra ID > Users > All users, open Per-user MFA and then its service settings. Note which verification options are ticked: call to phone, text message to phone, notification through mobile app, and verification code from mobile app or hardware token.
- Record the password reset methods. Go to Entra ID > Password reset > Authentication methods and note which methods are allowed there: mobile app notification, mobile app code, email, mobile phone, office phone, security questions.
- Match them in the authentication methods policy. Go to Entra ID > Authentication methods > Policies. For every method people should keep, make sure it is enabled and targeted here: Microsoft Authenticator for notifications and codes, Hardware OATH tokens or Third-party software OATH tokens for codes, SMS and Voice call only if you still want them, and Email OTP if it is used for password reset. Move people off text codes first if you are retiring them.
- Set the migration to in progress. Under Authentication methods > Policies, select Manage migration and choose Migration in progress. Entra then applies the authentication methods policy for MFA and password reset while still honouring the legacy settings, so nothing breaks while you check.
- Test without the legacy settings. Untick the verification options on the per-user MFA service settings and leave only security questions (if used) in Password reset > Authentication methods. Check a few people using different methods can still sign in and reset their password.
- Mark the migration complete. Select Manage migration again, choose Migration complete and save. From now on only the authentication methods policy decides which methods work for MFA and password reset, apart from security questions.
- Confirm. Manage migration shows Migration complete. Re-run the assessment to confirm the finding passes.
What users will notice
None if the methods match. Methods turned on only in the legacy policies stop working.
How to confirm it worked
Entra admin centre, Authentication methods, Policies, Manage migration shows Migration Complete.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-6 Use strong authentication controls |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.5.3 Use multi-factor authentication |
| CMMC Level 2 | IA.L2-3.5.3 Multifactor Authentication |
| ISO 27001:2022 | A.8.5 Secure authenticationA.8.9 Configuration management |
| CISA SCuBA | MS.AAD.3.4v1 Authentication methods migration set to complete |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage authentication methods migration (Microsoft Learn)