MFA Security Issues

Can Microsoft 365 Users Disable MFA Themselves? Admin Guide

John Wilson Oct 20, 2026 869 views

Question details

An administrator is investigating why over 300 Microsoft 365 user accounts had their Multi-Factor Authentication (MFA) disabled and needs to know if end users could have bypassed or changed these settings themselves.

Can Microsoft 365 Users Disable Multi-Factor Authentication Themselves?

Product: Microsoft 365
Device & OS: not provided
Scenario: Troubleshooting unexpected configuration changes to user security settings in an enterprise Microsoft 365 environment.
Observed behavior: Over 300 user accounts had their MFA requirement unexpectedly disabled without the known intervention of authorized administrators.

Before you start

Ensure you are logged into the Microsoft Entra admin center with Global Administrator, Authentication Administrator, or Security Administrator credentials to review directory logs and policies.

Solution 1Recommended

Investigate Microsoft Entra ID Audit Logs

Standard end users cannot disable MFA settings themselves. Reviewing audit logs is the most definitive way to identify which admin account, script, or system process triggered the MFA status change.

Because end users lack the required permissions to disable organizational MFA settings, the change was likely executed by a privileged account, an automated script, or a bulk update.

Access Entra Admin Center

Navigate to Audit Logs

In the left-hand navigation pane, expand 'Identity', select 'Users', and then click on 'Audit logs'.

Filter by Activity

Set the date range to when the unexpected changes likely occurred. Filter the 'Activity' column for 'Update user' or MFA-related events to locate the source of the modifications.

Investigate Microsoft Entra ID Audit Logs

Look for Automated Processes: Pay special attention to changes made by service principals or automated PowerShell scripts, as these can alter hundreds of accounts simultaneously without manual admin input.

Solution 2

Review Conditional Access Policies and Security Defaults

Misconfigured identity configurations, such as overriding Conditional Access policies or changes in Security Defaults, can inadvertently remove MFA requirements for large groups of users.

Free Microsoft Office alternative

Looking for a Secure and Manageable Office Suite Alternative?

While Microsoft 365 offers extensive enterprise controls like MFA, managing these IT environments can be complex and costly. If you are evaluating enterprise software costs, consider WPS Office as a free, lightweight, and highly compatible alternative that offers robust document handling without the complex administrative overhead.

1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install WPS Office: Run the downloaded installation file and follow the straightforward on-screen prompts to complete the setup.
3. Open and Secure Files: Launch WPS Office to immediately start opening, editing, and encrypting your existing Microsoft Office documents.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Lightweight installation with rapid deployment capabilities for large teamsFamiliar user interface requires zero learning curve for end usersBuilt-in document encryption and password protection to secure sensitive company files

microsoft office alternative - wps office

Frequently Asked Questions

Can end users disable MFA in Microsoft 365 on their own?

No, standard end users do not have the permissions to disable Multi-Factor Authentication for their own accounts. Only administrators with roles like Global Administrator or Authentication Administrator can alter these security configurations.

What happens to MFA if Security Defaults are turned off?

If Security Defaults are disabled in Microsoft Entra ID and no Conditional Access policies are actively replacing them to enforce MFA, users will no longer be prompted for multi-factor authentication during sign-in.

How can I check which administrators have access to change MFA settings?

In the Microsoft Entra admin center, navigate to 'Roles and administrators'. Review the active assignments for privileged roles such as Global Administrator, Privileged Role Administrator, and Authentication Administrator to see exactly who holds these permissions.

Microsoft Office Security Issues