Combined security information registration
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c6d773d · +7 −3 lines · also on GitHub
⋯ 113 unchanged lines
114114
115115
116116
### Session controls for Combined Registration
117
−By default, Combined registration enforces all MFA capable users to strongly authenticate prior to registering or managing their security info.
117
+By default, Combined registration enforces all MFA-capable users to strongly authenticate prior to registering or managing their security info.
118118
119
−- Adding or modifying a passkey (FIDO2) method requires users to have strongly authenticated within the past 5 minutes. If MFA hasn't been completed in the past 5 minutes, the user is asked to sign-in and complete fresh MFA.
119
+- Adding or modifying a passkey (FIDO2) method requires users to have strongly authenticated within the past 5 minutes. If MFA hasn't been completed in the past 5 minutes, the user is asked to sign in and complete fresh MFA.
120120
- Starting August 25, 2025, as announced in MC1135479, users are required to complete multifactor authentication (MFA) when managing credentials or accessing My Sign-ins if they haven't done so within the last 10 minutes of their current session.
121
−Enforcing Authentication Strengths to security info registration can conflict with both aforementioned requirements, with end-users potentially experiencing the error message *"Let’s try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in"*. Changes can be made at the tenant level, such as enforcing "Sign-in frequency: every time" to the "Register security info" user action or enabling Passkeys for Windows Hello for Business users, or at the user level, such as ensuring they authenticate with a session at most 10 minutes old or ensuring they authenticate with a combination of methods included in the enforced Authentication Strength.
121
+Enforcing authentication strengths for security info registration can conflict with both of these requirements. Users might experience the error message *"Let’s try something else. Another sign-in method is required to access this resource. Close your browser and try again, but choose another way to sign-in"*.
122122
123
+You can make changes at either the tenant level or the user level:
124
+
125
+- At the tenant level, enforce **Sign-in frequency: Every time** for the **Register security info** user action, or enable passkeys for Windows Hello for Business users.
126
+- At the user level, ensure that users authenticate with a session that's no more than 10 minutes old, or ensure that they authenticate with a combination of methods included in the enforced authentication strength.
123127
Organizations can modify the authentication requirements by defining [Conditional Access policies for securing security info registration](~/identity/conditional-access/policy-all-users-security-info-registration.md).
124128
125129
⋯ 71 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 05:03 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.