'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Why Microsoft 365 Prompts New Users for MFA Setup & How to Fix It
Question details
New users are prompted to register for Multi-Factor Authentication (MFA) during their first Windows sign-in or device enrollment.
- Product
- Microsoft 365
- Device & OS
- Windows
- Scenario
- Setting up a new Windows device or performing first-time user sign-in for a Microsoft 365 tenant.
- Observed behavior
- An unexpected MFA setup prompt appears during initial PC sign-in, even if per-user MFA is disabled and no Conditional Access policies are active.
Ensure you have global administrator access to the Microsoft 365 Admin Center and Microsoft Entra ID (formerly Azure AD) portal to check tenant-wide security policies.
Disable Security Defaults or Adjust SSPR Settings
Tenant-wide Security Defaults or Self-Service Password Reset (SSPR) policies often override per-user MFA settings and enforce registration.
Even when per-user MFA is disabled, Microsoft enables Security Defaults on new tenants to protect user identities. Similarly, if Self-Service Password Reset is enabled, it forces new users to register authentication methods upon their first login.
Sign in to the Microsoft Entra admin center as a Global Administrator. Go to 'Identity' > 'Overview' > 'Properties' and click 'Manage security defaults' at the bottom to verify if it is enabled.
In the Microsoft Entra admin center, navigate to 'Password reset' > 'Registration'. Check if 'Require users to register when signing in' is set to Yes.
If you do not want users to be prompted, you can disable these settings. However, it is highly recommended to leave them enabled and use Conditional Access policies for granular control.
Review Windows Device Enrollment and Hello for Business Policies
If the prompt only occurs during Windows device setup (and not at portal.office.com), device-join policies might be triggering it.
Experience a Simpler Office Suite with WPS Office
Tired of complex tenant configurations, unexpected MFA prompts, and expensive subscriptions? WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office. Enjoy a familiar interface without the administrative headache.
Frequently Asked Questions
Why does the MFA prompt appear on Windows setup but not on Office.com?
This usually happens because Windows device-join or Windows Hello for Business policies enforce multifactor authentication at the hardware or OS level, independently of Office 365 web sign-in rules.
Can I bypass the MFA registration prompt for new users temporarily?
Yes, you can temporarily bypass it by turning off Security Defaults or excluding the specific user from Conditional Access and SSPR policies, though leaving MFA enabled is a security best practice.
How do I check exactly which policy caused the MFA prompt?
You can identify the cause by checking the Microsoft Entra ID (Azure AD) sign-in logs. Filter by the user's name and look at the 'Authentication Details' and 'Conditional Access' tabs for the specific sign-in event.
