Users in Microsoft Entra ID have two distinct sets of contact information:
- Public profile contact information, which is managed in the user profile and visible to members of your organization. For users synced from on-premises Active Directory, this information is managed in on-premises Windows Server Active Directory Domain Services.
- Authentication methods, which are always kept private and only used for authentication, including multifactor authentication. Administrators can manage these methods in a user's authentication method blade and users can manage their methods in Security Info page of MyAccount.
When managing Microsoft Entra multifactor authentication methods for your users, Authentication administrators can:
- Add authentication methods for a specific user, including phone numbers used for MFA.
- Reset a user's password.
- Require a user to re-register for MFA.
- Revoke sessions.
- Delete a user's existing app passwords
Note
The screenshots in this topic show how to manage user authentication methods by using an updated experience in the Microsoft Entra admin center. There's also a legacy experience, and admins can toggle between the two using a banner in the admin center. The modern experience has full parity with the legacy experience, and it manages modern methods like Temporary Access Pass, passkeys, and other settings.
The legacy experience in the Microsoft Entra admin center retired on Sept. 30, 2025. There's no action required by organizations before the retirement.
Add or change authentication methods for a user
You can add or change authentication methods for a user by using the Microsoft Entra admin center or Microsoft Graph PowerShell.
In the Microsoft Entra admin center, the legacy method for managing user authentication methods retires after Sept. 30, 2025.
Note
For security reasons, public user contact information fields shouldn't be used to perform MFA. Instead, users should populate their authentication method numbers to be used for MFA.
👁 Screenshot of how to add authentication methods from the Microsoft Entra admin center.
To add or change authentication methods for a user in the Microsoft Entra admin center:
- Sign in to the Microsoft Entra admin center as at least an Authentication Administrator.
- Browse to Entra ID > Users.
- Choose the user for whom you wish to add or change an authentication method and select Authentication methods.
- At the top of the window, select + Add authentication method.
- Select a method (phone number or email). Email may be used for self-password reset but not authentication. When adding a phone number, select a phone type and enter phone number with valid format (such as
+1 4255551234).
- Select Add.
Users can add or edit their own authentication methods in My Sign Ins | Security info.
For example, to change the phone number, select Phone number and tap Change.
Manage methods using PowerShell
Install the Microsoft.Graph.Identity.Signins PowerShell module using the following commands.
Install-module Microsoft.Graph.Identity.Signins
Connect-MgGraph -Scopes "User.Read.all","UserAuthenticationMethod.Read.All","UserAuthenticationMethod.ReadWrite.All"
Select-MgProfile -Name beta
List phone based authentication methods for a specific user.
Get-MgUserAuthenticationPhoneMethod -UserId balas@contoso.com
Create a mobile phone authentication method for a specific user.
New-MgUserAuthenticationPhoneMethod -UserId balas@contoso.com -phoneType "mobile" -phoneNumber "+1 7748933135"
Remove a specific phone method for a user
Remove-MgUserAuthenticationPhoneMethod -UserId balas@contoso.com -PhoneAuthenticationMethodId 00aa00aa-bb11-cc22-dd33-44ee44ee44ee
Authentication methods can also be managed using Microsoft Graph APIs. For more information, see Authentication and authorization basics.
