MFA Security Issues

Can Users Opt Out of Microsoft 365 Multifactor Authentication?

Amos Gikunda Oct 22, 2026 869 views

Question details

Administrators need to know if specific users can be exempted from the mandatory 14-day Microsoft 365 MFA registration, or if there are alternative methods for users lacking mobile phones.

Can Users Opt Out of Microsoft 365 Multifactor Authentication?

Product: Microsoft 365
Device & OS: not provided
Scenario: Users are prompted to register for two-factor authentication within 14 days, but several cannot complete the setup because they do not own mobile phones.
Observed behavior: Affected users are at risk of being locked out of their Microsoft 365 accounts once the 14-day MFA registration grace period expires.

Before you start

Before modifying your organization's authentication policies, ensure you are logged into the Microsoft Entra admin center with Global Administrator or Conditional Access Administrator privileges.

Solution 1Recommended

Provide Hardware-Based Authentication Alternatives

Instead of completely disabling MFA, configure hardware-based authentication methods like FIDO2 security keys or OATH hardware tokens for users without mobile phones.

Microsoft strongly advises against broadly disabling MFA due to severe security risks. Utilizing hardware security keys provides the highest level of account protection while successfully accommodating users who cannot use a mobile authenticator app or SMS.

Access the Microsoft Entra admin center

Navigate to Authentication Methods

In the left-hand navigation menu, expand the 'Protection' section and click on 'Authentication methods'.

Enable Hardware Tokens or FIDO2 Keys

Select 'Policies' from the menu. Click on 'FIDO2 security key' or 'OATH hardware tokens', switch the 'Enable' toggle to 'Yes', and target these methods specifically to the group of users lacking mobile phones.

Provide Hardware-Based Authentication Alternatives

Best Practice: Hardware tokens ensure your tenant remains secure against credential theft while remaining compliant with Microsoft's recommended security baselines.

Solution 2

Configure Conditional Access Policy Exclusions

If alternative authentication hardware is not feasible, administrators can create carefully scoped exclusions within Conditional Access policies to exempt specific users from the MFA requirement.

Free Microsoft Office alternative

Looking for a Hassle-Free Office Suite? Try WPS Office

While Microsoft 365 requires strict cloud security policies and complex MFA administration, WPS Office provides a powerful, locally-installable alternative. Enjoy full compatibility with your existing Microsoft Office files without the mandatory cloud connectivity or intricate tenant management.

1. Download the Installer: Visit the official WPS Office website to download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded installer file and follow the straightforward on-screen instructions.
3. Open Your Documents: Launch WPS Office to instantly open, edit, and save your existing .docx, .xlsx, and .pptx files.

Free and lightweight office suite for offline and online useFully compatible with Microsoft Word, Excel, and PowerPoint formatsNo complex tenant administration or mandatory cloud MFA requiredFamiliar user interface ensuring a seamless migration for your team

microsoft office alternative - wps office

Frequently Asked Questions

What happens if a user ignores the 14-day MFA registration prompt?

After the 14-day grace period expires, the user will be completely locked out of their Microsoft 365 applications and services until they successfully register an approved authentication method.

Can I completely disable MFA for my entire Microsoft 365 organization?

While technically possible by disabling Security Defaults or disabling all Conditional Access policies, it is highly discouraged by Microsoft. Doing so removes critical protections and significantly increases the risk of account compromise across your entire tenant.

Are hardware security keys fully supported in Microsoft 365?

Yes, Microsoft Entra ID fully supports FIDO2 security keys and OATH hardware tokens. These serve as valid, highly secure MFA methods for users who cannot use a mobile authenticator app or receive SMS codes.

Microsoft Office Security Issues