Step 1: Prompt the user to enroll with 1Password

The user can add a new authenticator method via:

Self-service account management (paid plans):

• User navigates to their account page → Manage two-factor → Add two-factor → Authenticator app
• Scan the new QR code with 1Password, including providing a name
• See: Add Authenticator as a second factor

You can also build your own page using the APIs.

This approach ensures a clean transition between authenticator apps without conflicts or confusion.

Step 2: Remove the existing Microsoft Authenticator method

You have two options:

Option A: Admin UI

• Navigate to Users → [Select User] → Multi-Factor tab
• Click the red trash icon to remove the authenticator method
• An admin role can do this without requiring a one-time code from the user
• An mfa_deleter role can do this, but confirmation from the user is required.
• See: Disable MFA documentation

Option B: User API (programmatically)

• GET the user object
• Remove the authenticator entry from the twoFactor.methods array
• PUT the updated user object back
• This requires no code from the user and is useful for support scenarios (e.g., user lost their device)
• Note: Use PUT rather than PATCH due to how arrays are handled in the API

This approach ensures that the user always has MFA enabled, but requires action on their part.

If you reverse them, but use an MFA policy of Required (or one of the intelligent MFA policies), then users will be forced to re-enroll.

Related Documentation

• Multi-Factor Authentication (MFA) Overview
• Disable MFA on a User
• Add Authenticator as a Second Factor
• Self-Service Account Management
• Update a User API
• Disable Multi-Factor API