Disabling SMS for various users

[tiffany202]

Hello,

My organization currently has SMS as an auth method. We want to disable this method soon, but have a large number of various users still using it. A suggestion was to allow those using it for the time being, but disable the option for others (to not increase the usage more). How could I structure a policy to either allow those who use it continue or to disable it for the others to not have as a choice? I thought maybe some sort of user group, but they are all synced in by different groups (usually by dept) and how it could be tested out.

[Ken Stieers]

Create a new group in Duo.
Add the users to it manually.
Create a User Policy and set the auth methods to NOT include SMS
Apply that to the applications.

[tiffany202]

Thank you. Since our Global policy allows SMS, would these 2 policies conflict with each other? I haven't had much experience with creating them or adding apps, so this is all very new to me.

[Ken Stieers]

I'm the engine will apply this setting over the global one because its more specific.
You could build out a test app that mirrors one of the apps you have and use the Policy Calculator (under Policy/Policy Calculator) to see how it all comes together without affecting live authentications.

[DuoKristina]

I'd actually suggest the opposite:

1. Create a new custom policy that allows SMS.
2. Create a group of just the users who still need to use SMS for now. If you sync users and groups from an external directory, you will need to create the group of SMS users in the external directory and add it to your sync config.
3. Apply the custom policy allowing SMS from step 1 as a user-group policy to the group of SMS users in step 2.
4. Global Policy - disable SMS so that no new users can enroll it.
5. As you get SMS users to set up a different authentication method, remove them from the SMS users group,
6. Delete the SMS users group and custom policy when no users need to log in with SMS anymore.

Result:

• New users can't enroll SMS, so the pool of SMS users doesn't increase.
• Graceful migration of users from SMS use to no SMS.
• Easy cleanup when SMS use is done.