To migrate a user from Microsoft Authenticator to 1Password (or any other TOTP authenticator app), the recommended approach is to remove the old method first, then have the user re-enroll with the new app.

Step 1: Prompt the user to enroll with 1Password

The user can add a new authenticator method via:

Self-service account management (paid plans):

User navigates to their account page → Manage two-factor → Add two-factor → Authenticator app Scan the new QR code with 1Password, including providing a name See: Add Authenticator as a second factor

You can also build your own page using the APIs.

This approach ensures a clean transition between authenticator apps without conflicts or confusion.

Step 2: Remove the existing Microsoft Authenticator method

You have two options:

Option A: Admin UI

Navigate to Users → [Select User] → Multi-Factor tab Click the red trash icon to remove the authenticator method An admin role can do this without requiring a one-time code from the user An mfa_deleter role can do this, but confirmation from the user is required. See: Disable MFA documentation

Option B: User API (programmatically)

GET the user object Remove the authenticator entry from the twoFactor.methods array PUT the updated user object back This requires no code from the user and is useful for support scenarios (e.g., user lost their device) Note: Use PUT rather than PATCH due to how arrays are handled in the API

This approach ensures that the user always has MFA enabled, but requires action on their part.

If you reverse them, but use an MFA policy of Required (or one of the intelligent MFA policies), then users will be forced to re-enroll.

Related Documentation Multi-Factor Authentication (MFA) Overview Disable MFA on a User Add Authenticator as a Second Factor Self-Service Account Management Update a User API Disable Multi-Factor API