Fix Microsoft Entra ID New Users Not Prompted to Register for MFA
Question details
New Microsoft Entra ID users are bypassing the multifactor authentication (MFA) registration prompt when signing in from trusted IP networks.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Onboarding new enterprise users and requiring them to set up their MFA methods while connected to a trusted corporate office network.
- Observed behavior
- Because Conditional Access policies exclude trusted locations from MFA requirements, new users are not challenged for MFA, which completely bypasses the initial MFA registration prompt.
Ensure you have Conditional Access Administrator or Global Administrator privileges in your Microsoft Entra ID tenant to review and modify sign-in security policies.
Configure a Dedicated MFA Registration Policy
Create a Conditional Access policy specifically targeting security information registration so users are prompted to register even on trusted networks.
When your primary Conditional Access policy requires MFA but excludes trusted IP addresses, users on those trusted networks are never challenged for MFA. If they are never challenged, the system never forces them to register their security information.
To resolve this, you must separate the registration requirement from your standard sign-in requirements.
Sign in to the Microsoft Entra admin center, expand the 'Protection' menu, and select 'Conditional Access'.
Click on 'Create new policy' and give it a descriptive name, such as 'Require MFA Registration for New Users'.
Under 'Target resources' (or Cloud apps or actions), select 'User actions' from the dropdown, and check the box for 'Register security information'.
Ensure you do not exclude trusted locations for this specific policy. Under the 'Grant' controls, select 'Require multifactor authentication' and turn the policy on.
Consult Microsoft Entra Community Support
If adjusting your Conditional Access policies does not resolve the behavior, reach out to Microsoft's official support channels for tenant-specific diagnostics.
Manage IT Policies and Documentation Efficiently with WPS Office
Managing complex Microsoft Entra ID configurations requires drafting detailed IT policies, tracking user groups in spreadsheets, and presenting security guidelines to staff. WPS Office is a highly compatible, free alternative to Microsoft Office that gives IT administrators all the tools they need to maintain documentation without the heavy subscription costs.
Frequently Asked Questions
Why does a trusted IP bypass the MFA registration prompt?
When a user signs in from an IP address designated as a trusted location, Conditional Access policies that exclude those locations will skip the MFA challenge. Because the user isn't challenged for MFA, the system does not trigger the initial MFA setup wizard.
Can I force a specific user to re-register their MFA methods?
Yes. An administrator can locate the user's profile in the Microsoft Entra admin center, navigate to 'Authentication methods', and select 'Require re-register multifactor authentication'. This will force the prompt on their next sign-in.
Is it possible to restrict MFA registration strictly to office networks?
Yes. You can create a Conditional Access policy targeting the 'Register security information' user action and explicitly set the condition to only grant access when the user is connecting from a designated trusted IP location.
How do I test my Conditional Access policy without locking users out?
You can use the 'Report-only' mode when creating or modifying a Conditional Access policy. This allows you to evaluate how the policy would impact users via the Entra ID sign-in logs without actually blocking or forcing prompts.
