Migrate legacy MFA and SSPR to Authentication methods policy

The legacy multifactor authentication (MFA) and self-service password reset (SSPR) policies will soon deprecate. This means you must migrate these legacy policies to the new converged Authentication methods policy for Azure Active Directory. In this article, you will learn how to migrate from legacy MFA and SSPR policies to converged Authentication methods policy.

Legacy MFA and SSPR policies deprecated

Microsoft has announced the deprecation of managing authentication methods in the legacy multifactor authentication (MFA) and self-service password reset (SSPR) policies. To avoid any service impact, it’s recommended to migrate these old MFA and SSPR policies by September 2025 to the new converged (unified) Authentication methods policy.

After you complete the migration, you can manage all authentication methods together in the Authentication methods policy. It allows you to create tenant-wide authentication policies from a single configuration page in the Microsoft Entra admin center.

We will show you how to migrate MFA and SSPR policy settings to the Authentication methods policy for Azure AD (Microsoft Entra ID).

Authentication methods policies

Before we start the migration process, we need to know which authentication methods our organization enabled in the Microsoft Entra ID.

Follow these steps to see the authentication methods policies:

1. Sign into Microsoft Entra admin center
2. Click Protection > Authentication methods
3. Go to Policies

You will see a list of all the authentication methods. If this is a new tenant, then it will have all the methods disabled by default.

You need to enable at least one authentication method for all users. In our example, we will only enable the Microsoft Authenticator.

4. Click on Microsoft Authenticator

5. Click Enable
6. Select All users
7. Click Save

8. The method Microsoft Authenticator enabled for all users

Start legacy MFA and SSPR policies migration

You can manage the migration in Azure AD or Entra portal. In our example, we will show you how to start the migration process in the Microsoft Entra admin center.

How to start legacy MFA and SSPR policies migration process:

1. Sign into Microsoft Entra admin center
2. Click Protection > Authentication methods
3. Click Manage migration

4. Select Migration in Progress
5. Click Save

If the Migration in Progress already is selected, you don’t need to do anything here.

1. Check legacy per user multi-factor authentication

We need to check the legacy mfa in the old portal, which you can access in two ways:

• Microsoft 365 admin center
• Azure Active Directory

We will show you both options in the next step.

Option 1: Legacy MFA in Microsoft 365 admin center

First, we will see the see the legacy MFA in the Microsoft 365 admin center:

1. Sign into Microsoft 365 admin center
2. Expand Show all

3. Click Users > Active users
4. Click Multi-factor Authentication

The Configure multifactor authentication (MFA) opens in a new tab.

5. Click Legacy per-user MFA

The old multi-factor authentication portal opens in a new tab.

Option 2: Legacy MFA in Azure AD portal

We can also view the old MFA portal in Azure Active Directory.

1. Sign into Microsoft Azure
2. Open the menu
3. Click Azure Active Directory

4. Click Users

5. Click Per-user MFA

It will open the old multi-factor authentication portal. Here, you will see a list of all the users with the multi-factor authentication status.

6. Check your user MFA status

You don’t need to do anything here but continue to the next step.

2. Remove legacy MFA service settings

The next step is to remove the MFA service settings in the old portal.

The old multi-factor authentication portal opens:

1. Click service settings
2. You will find the verification options selected

We want to clear all the check boxes under verification options.

3. Clear check box Text message to phone
4. Clear check box Notification through mobile app
5. Clear check box Verification code from mobile app or hardware token
6. Click Save

The update operation completed successfully!

7. Click close

3. Remove legacy SSPR settings

You also need to remove the legacy password reset policy saved in Microsoft Entra ID.

1. Sign into Microsoft Entra admin center
2. Click Protection > Password reset
3. Click Authentication methods
4. See the password reset methods that are selected

5. Clear all methods
6. Click Save

It successfully saved the changes to the password reset policy.

Complete migration to converged Authentication methods

The final step is to complete the migration in Microsoft Entra ID.

1. Go to Microsoft Entra admin center
2. Click Protection > Authentication methods
3. Click Manage migration

4. Select Migration Complete
5. Click Save

You successfully completed the migration.

Verify converged Authentication methods migration completion

You can verify that the old legacy MFA and SSPR policies are disabled correctly.

Verify all methods in legacy SSPR policy disabled:

1. Go to Microsoft Entra admin center
2. Click on Protection > Password reset
3. Click Authentication methods

You will see that all the methods used for password reset are greyed out, except for security questions.

Verify all methods in legacy MFA policy disabled:

1. Go to the old multi-factor authentication portal
2. Click service settings

Under verification options, it says that all these methods are now being managed in the authentication methods policy. You can see that all the methods available to the users are greyed out.

You are all set!

Read more: How to improve Microsoft Entra MFA security »

Conclusion

You learned how to migrate from legacy MFA and SSPR policies to Authentication methods policy. Before you start the migration, you need to enable at least one authentication method for all the users in the new Authentication methods. When you start the migration process, you must disable the old methods in the legacy MFA and SSPR policies. Lastly, you can complete the migration in the Microsoft Entra admin center.

Did you enjoy this article? You may also like Reset MFA for Microsoft 365 user. Don’t forget to follow us and share this article.