Setting up Microsoft Authenticator for MFA
Microsoft Authenticator is now available as an authentication method in the Evo Portal for users synced from Microsoft Entra ID (formerly Azure Active Directory).
Prerequisites
Azure Permissions
Before enabling Microsoft Authentication or using the Microsoft Help Desk Verification (HDV) flow, confirm the directory has the required Azure/OAuth permissions.
Important notes
- Directories created on Evo before January 2025 may not automatically include the required Azure permissions for:
- Microsoft Authentication
- Help Desk Verification (HDV)
- You may be prompted to grant these permissions:
- During directory configuration, or
- While completing the Help Desk Verification flow.
- Only users with the Edit Directory permission can grant the required OAuth permissions on these screens.
If you can’t grant permissions
- Verify your admin role includes Edit Directory, or ask a Portal Admin to update your role/permissions.
Ensure Azure Multi-Factor Auth Client, Azure MFA StrongAuthentocationService, Azure Multi-Factor Auth Connector are listed as an Enterprise Application and Enabled
Note: These settings are required for the feature to work and are typically enabled by default. If you encounter issues, verify these settings first as part of your initial troubleshooting steps.
• Navigate to Microsoft Entra ID → Enterprise Applications • Search for: Azure Auth ◦ Ensure search filters are turned off • Open each Application • Ensure: ◦ Enabled for sign-in = Yes • Save changes
Configure Microsoft Authenticator in an Evo Portal policy
To allow Microsoft Authenticator as an MFA option, you’ll need to enable it within an Evo policy.
Steps
- In the Evo Portal, navigate to Evo Admin → Policies.
- Click + New (top-right).
- From the policy type dropdown, select Allowed Authentication Methods.
- In the available methods list, select Microsoft Authenticator as an allowed MFA method.
- Save the policy and apply it to the appropriate Tenant.
User device setup (Microsoft Entra ID users)
Users synced from a Microsoft Entra ID (Azure) directory must register Microsoft Authenticator in Microsoft before it can be used in Evo.
Steps
- Select + Add sign-in method
- Follow the prompts to add and complete setup for Microsoft Authenticator
Ensure the default method is set correctly
If a user has multiple MFA methods registered in Microsoft (for example, SMS and Authenticator), Microsoft Authenticator push notifications must be set as the default sign-in method.
Steps
- Select Change next to “Sign-in method when most advisable is unavailable”
- Choose App-based authentication – notification and save your changes
