Prepopulating MFA phone authentication (Multi-Factor Authentication) details on a user in Azure Active Directory means getting a known second factor added to a user's account details automatically. These details are also known as the user's "Strong Authentication Methods."

Normally MFA enrollment is a manual process done with the Microsoft Authenticator App during first sign-in. However, a more basic second factor, the user's cellular/mobile number, is usually known to IT in a corporate environment.

With a recent addition to the Microsoft Graph API, it is now possible to add or replace a user's strong authentication phone method programmatically. This enables you to register users automatically for MFA and SSPR at the same time.

The solution uses the following Microsoft technologies:

The solution requires delegated permissions with one of these roles:

Create a new Automation Account with a RunAs account. Configure the subscription, resource group, location, and leave "Create Azure Run As account" on "Yes".

Set the App registration to treat the application as a public client under AUTHENTICATION > DEFAULT CLIENT TYPE > YES.

Assign the AUTHENTICATION ADMINISTRATOR role:

If using PIM, assign as ACTIVE and PERMANENTLY ASSIGNED:

Create a credential called DELEGATESERVICEACCOUNT with the service account username and password.

Download the script from GitHub: AzAutomationScript4MFAPrePopulate.ps1 (https://github.com/MSEndpointMgr/AzureAD/blob/master/AzureMFAProvisioning/AzAutomationScript4MFAPrePopulate.ps1)

Or use the automated deployment ARM template:

Example Kusto queries for monitoring:

Microsoft's preview dashboard for monitoring MFA/SSPR deployment:

This was a collaboration between @michael_mardahl, @jankeskanke, and @sandy_tsang. The solution is provided freely to the community as inspiration.