'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Configure Microsoft 365 MFA Alternatives for Small Businesses
Question details
Small businesses need to configure alternative Microsoft 365 authentication methods so employees do not have to use company phones, and they need to know proper offboarding procedures for departing staff.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Setting up multi-factor authentication (MFA) methods for staff without dedicated company devices and handling account security during employee departures.
- Observed behavior
- Administrators require alternative verification methods like SMS or voice calls instead of the Authenticator app, alongside safe protocols for blocking access when an employee leaves the company.
Ensure you are logged in to the Microsoft Entra admin center with an account that has Global Administrator privileges, as these permissions are required to modify organization-wide authentication policies.
Enable SMS and Phone Call MFA Alternatives
Configure your tenant policies to allow employees to receive authentication verification codes via SMS text messages or voice calls.
Depending on your tenant configuration and licensing, administrators can enable SMS-based authentication. This allows users to authenticate using their personal mobile devices without requiring the installation of the Microsoft Authenticator app.
Log in to the Microsoft Entra admin center as a Global Administrator.
Go to Protection in the left sidebar, click on Authentication methods, and select Policies.
Select the 'SMS' or 'Voice call' method from the list, toggle the setting to 'Enable', and assign it to the 'All users' group or specific selected groups.
Click 'Save' to apply the policy. Users will now be prompted to register their phone numbers for text or voice verification during their next login.
Execute Secure Employee Offboarding Procedures
Follow best practices to properly revoke Microsoft 365 access and authentication methods when an employee leaves the business.
Looking for a Simpler Software Solution? Try WPS Office
While managing Microsoft 365 security policies requires complex administrative configurations, WPS Office provides small businesses with a lightweight, highly secure, and user-friendly alternative. Enjoy powerful tools for your business operations without the heavy administrative overhead.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the Software: Run the installer and follow the quick on-screen instructions to set up the suite on your device.
- 3. Open and Edit Business Files: Launch WPS Office and immediately open your existing Microsoft Office files to resume work seamlessly.
Frequently Asked Questions
Can I turn off MFA completely for my small business?
It is highly discouraged to disable MFA entirely. You should only disable multi-factor authentication if there is a documented security reason and you have already deployed an approved alternative security replacement.
Can employees use their personal phones for Microsoft 365 MFA verification?
Yes, if the Global Administrator configures the authentication policies to allow SMS or voice calls, employees can securely use their personal phone numbers to receive verification codes without needing a company-issued device.
Who has permission to change MFA methods in Microsoft 365?
Only users assigned the Global Administrator or Authentication Policy Administrator roles can modify and configure the allowed authentication methods for the organization's tenant.
How do I remove an ex-employee's personal phone from their Microsoft 365 MFA settings?
A Global Administrator must log into the Microsoft Entra admin center, locate the specific user, select 'Authentication methods' under their profile, and delete the registered mobile phone number or linked authentication apps.
