Why Outlook on the Web Requires MFA Enrollment & How to Fix It
Question details
Users are being prompted to enroll in Multi-Factor Authentication (MFA) without the option to skip when attempting to log into Outlook on the web.
- Product
- Exchange Online / Outlook on the Web
- Device & OS
- not provided
- Scenario
- Accessing Outlook on the web with a Microsoft 365 account, such as a Business Basic license, and being blocked by a mandatory MFA setup screen.
- Observed behavior
- The system mandates MFA enrollment because basic authentication is deprecated, and modern authentication or tenant security defaults are strictly enforced.
You will need Global Administrator or Security Administrator privileges in your Microsoft 365 / Microsoft Entra ID (formerly Azure AD) tenant to view or modify authentication policies.
Review and Adjust Microsoft Entra ID Security Defaults
Check if your tenant's security defaults are turned on, which automatically enforces MFA for all users in the organization.
Microsoft introduced security defaults to help protect organizations from identity-related attacks. When enabled, this feature requires all users to register for MFA. This is a tenant-wide setting and does not depend on specific license types.
Log in to the Microsoft Entra admin center as at least a Security Administrator.
Go to Identity > Overview > Properties in the left-hand navigation menu.
Scroll to the bottom of the Properties page and click on 'Manage security defaults'.
Review the toggle. If it is set to 'Enabled', this is what is forcing the MFA prompt. You can choose to disable it if you plan to use Conditional Access policies instead, but keeping it enabled is highly recommended by Microsoft for security.
Check Conditional Access Policies
If security defaults are disabled, specific Conditional Access policies might be targeting your users and enforcing the MFA requirement.
Experience a Simpler Workflow with WPS Office
Dealing with complex Microsoft 365 tenant configurations and mandatory policy updates can be frustrating for simple tasks. WPS Office offers a free, lightweight, and user-friendly alternative to Microsoft Office, complete with seamless format compatibility and an intuitive interface that just works.
Frequently Asked Questions
Can I still use basic authentication for Exchange Online to avoid MFA?
No. Microsoft has deprecated basic authentication for Exchange Online to improve security. Modern authentication is now the standard, which inherently supports and often requires MFA.
Does the MFA requirement only apply to specific licenses like Business Basic?
No, the MFA requirement is triggered by tenant-wide security policies, Conditional Access, or security defaults. It affects users regardless of their specific Microsoft 365 license type.
How can users bypass the MFA setup screen in Outlook Web?
If the organization has enabled security defaults or strict conditional access policies, users cannot skip the MFA enrollment process. Administrators must explicitly configure exemptions in the Microsoft Entra admin center if absolutely necessary, though this is discouraged for security reasons.
Why did this MFA prompt suddenly appear for my users?
Microsoft sometimes automatically enables security defaults for tenants that haven't modified their security settings to protect against unauthorized access. Additionally, the final rollout of the basic authentication deprecation forces all logins through modern authentication flows, triggering MFA prompts.
