In many tenants I work in, the settings for multi-factor authentication (MFA) and self-service password reset (SSPR) are still split across the old, separate policy portals. Over time that creates confusion and an inconsistent security posture. One team turns on SMS in one place, another configures Authenticator somewhere else, and before long nobody can say for sure what's allowed. Microsoft has now made it clear that the legacy MFA and SSPR policies will be retired by September 30, 2024, so the new Authentication methods policy in Entra ID isn't optional anymore. I'd start the migration now.

The new Authentication methods policy puts every method in one place

The converged Authentication methods policy finally manages all methods together: Microsoft Authenticator (including number matching), OATH tokens, SMS and voice calls. You no longer juggle separate settings with overlapping scopes. Instead you get one place to control everything, with group targeting, better visibility and simpler management. The new policy sits in Entra ID under "Protection" > "Authentication methods." Microsoft's documentation has a solid introduction to managing authentication methods.

In practice, you have to migrate your existing configuration. Microsoft has built a migration control directly into the portal that shows a status for each method, either Pre-migration, Migration in progress or Migration complete. The old policies are only fully switched off once you've completed the migration for every relevant method.

Each method moves through three migration states

People are often unsure how far along their migration actually is. Microsoft's migration experience tracks three states per method:

flowchart TD
  pre["Pre-migration"] --> progress["Migration in progress"]
  progress --> complete["Migration complete"]

Figure: The stages a method goes through when migrating authentication methods in Entra ID

In Pre-migration, the legacy settings from the MFA and SSPR portals still apply. Once you set a method to Migration in progress, the new Authentication methods policy is enforced, though the old settings stay visible for reference and as a fallback. The legacy policies stop applying only when you reach Migration complete. In larger environments especially, I move one method at a time so I can check the results and avoid surprises.

Most tenants still have four methods to map and target

Your tenant probably has at least these methods configured:

  • Microsoft Authenticator (with or without number matching)
  • SMS
  • Voice call
  • OATH hardware tokens

SMS and voice are frequently still enabled out of habit or for compatibility, even though Microsoft has been pushing everyone toward stronger authentication for a while. Number matching in Microsoft Authenticator has been mandatory since mid-2023, and with the rollout of "system-preferred MFA" (see the documentation), stronger methods get priority automatically. The new policy makes it much easier to allow or block methods per group. That way you can begin retiring weaker options like SMS and voice without flipping a switch for the whole tenant.

Pro tip: Export your current authentication method settings before you start the migration. PowerShell is the best tool for this, for example with Get-MsolUser or the Entra module. Having that export makes troubleshooting edge cases much easier later on.

Group targeting is the real advantage of the new policy

Being able to assign authentication methods per group is a real step forward. The old controls applied to the whole tenant or not at all. Now you can enable, test or restrict individual methods for pilot users, admins or high-risk groups. Rolling out passwordless sign-in or the Microsoft Authenticator app gets a lot easier when you don't have to disrupt everyday work. To check your current setup with PowerShell, you can run:

Get-MgPolicyAuthenticationMethodPolicy -PolicyId default | Select-Object -ExpandProperty AuthenticationMethodConfigurations

The migration is a chance to move toward stronger authentication

Use the migration to take a hard look at which methods your users actually need. Microsoft explicitly recommends getting rid of SMS and voice for MFA as soon as you can. With system-preferred MFA turned on, users are asked for stronger methods by default. Microsoft's how-to on managing authentication methods has more guidance.

In my projects, communication usually turns out to be the hardest part. Users who are used to SMS codes need clear announcements and step-by-step instructions for switching to Microsoft Authenticator. They also need a plain explanation of why the change improves their security.

In my view this migration is a must-do and not a nice-to-have

The legacy policies won't be retired for several months, but starting now spares you a last-minute rush. The Authentication methods policy in Entra ID is more than a new feature. It's the new baseline for identity that is secure and manageable. If you're already rolling out Windows LAPS with Intune or working on similar endpoint projects, it makes sense to modernize authentication at the same time. You end up with less confusion, more control and stronger credentials throughout the tenant. For me, moving to the Authentication methods policy belongs on every 2024 roadmap.