'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Microsoft 365 MFA Shows Disabled Despite Azure Configuration
Question details
The Microsoft 365 admin center incorrectly displays a user's Multi-Factor Authentication (MFA) status as 'Disabled', even when the user has configured the Microsoft Authenticator app and is protected by Azure policies.
- Product
- Microsoft 365 / Microsoft Entra
- Device & OS
- not provided
- Scenario
- An administrator is checking user MFA statuses in the Microsoft 365 admin center after implementing Azure AD Conditional Access policies.
- Observed behavior
- The per-user MFA status shows as 'Disabled' instead of 'Enabled' or 'Enforced', creating confusion about whether the user is actually protected by MFA.
Ensure you have Global Administrator or Security Administrator privileges in your Microsoft tenant to access and review Microsoft Entra (Azure AD) Conditional Access policies.
Verify MFA via Conditional Access in Microsoft Entra Admin Center
Use this method to confirm if MFA is being properly enforced by your tenant's security policies rather than legacy per-user settings.
Per-user MFA settings in the Microsoft 365 admin center are considered a legacy portal and do not reflect MFA enforcements applied through Azure Active Directory (now Microsoft Entra) Conditional Access policies.
If your organization uses Conditional Access to require MFA, the per-user status will remain 'Disabled' by design to avoid conflicts. You must check the policy enforcement directly in Entra.
Navigate to the Microsoft Entra admin center (entra.microsoft.com) and sign in using your administrator credentials.
Go to Protection > Conditional Access. Review your active security policies to confirm that the policy requiring Multi-Factor Authentication is enabled and targets the appropriate users or groups.
Navigate to Identity > Users > All users. Select the specific user in question, then click on 'Authentication methods' from the left menu to ensure they have successfully registered the Microsoft Authenticator app.
Streamline Your Administrative Tasks with WPS Office
While resolving complex Microsoft 365 administration issues, you still need a reliable tool for your daily documentation. WPS Office provides a lightweight, entirely free office suite that natively supports Microsoft formats, making it the perfect companion for IT professionals managing reports, policy documents, and data spreadsheets.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the downloaded setup file and follow the quick on-screen prompts to complete the installation.
- 3. Open Your Documents: Launch WPS Office to instantly open, edit, and save your existing Microsoft Office files without any formatting loss.
Frequently Asked Questions
Why does Azure MFA provide better security than standard Office 365 MFA?
Azure Multi-Factor Authentication (managed via Conditional Access) offers advanced features such as location-based rules, device compliance checks, fraud protection, and detailed authentication logs, which are not available in basic Office 365 per-user MFA.
Should I manually change the MFA status to 'Enabled' in the Microsoft 365 admin center?
No. If you are using Conditional Access policies to enforce MFA, leave the per-user status in the Microsoft 365 admin center as 'Disabled'. Enabling both can result in conflicting requirements and prompt fatigue for your users.
How can I check which authentication devices a user has registered?
You can verify a user's registered devices by logging into the Microsoft Entra admin center, navigating to 'Users', selecting the user, and clicking on 'Authentication methods'. This will display their registered Authenticator apps, phone numbers, and hardware tokens.
Will Microsoft fix this 'Disabled' display issue in the M365 admin center?
The 'Disabled' status is technically accurate for the legacy per-user MFA setting, so it is not considered a bug. Microsoft encourages administrators to transition fully to the Microsoft Entra portal to monitor Conditional Access and user authentication methods.
