MFA Security Issues

Fix Microsoft Entra Security Defaults Not Prompting Users for MFA

John Wilson Oct 16, 2026 869 views

Question details

Users are not being prompted to register for multifactor authentication (MFA) after administrators enable Microsoft Entra Security Defaults.

Fix Microsoft Entra Security Defaults Not Prompting Users for MFA

Product: Microsoft Entra
Device & OS: not provided
Scenario: Administrators expect users to be immediately forced to register for MFA upon their next sign-in once Security Defaults are enabled.
Observed behavior: Users bypass the MFA registration prompt entirely during browser sign-ins because they are within the registration grace period or not accessing sensitive resources.

Before you start

Ensure you have Global Administrator or Security Administrator credentials in the Microsoft Entra admin center to view user details and manage authentication sessions.

Solution 1Recommended

Wait for the Grace Period or Access Sensitive Resources

Understand how Security Defaults handle MFA prompts through grace periods and conditional access scenarios.

Microsoft Entra Security Defaults do not always require MFA registration on the very first sign-in. Instead, users are granted a 14-day grace period. During this time, registration can be skipped.

Additionally, rather than prompting on every single browser sign-in, MFA challenges are often triggered only when a user attempts to access resources that the system deems sensitive.

Verify the 14-day grace period

Check when the Security Defaults were enabled for the user. If it has been less than 14 days, the user will see a prompt to register but can choose to postpone it. After 14 days, the registration becomes mandatory during an interactive sign-in.

Trigger an immediate prompt via sensitive access

Instruct the user to log into the Microsoft 365 portal and attempt to open a highly secure app, such as the Admin center or a heavily restricted SharePoint site. This action bypasses the casual sign-in rules and forces an immediate MFA challenge.

Wait for the Grace Period or Access Sensitive Resources

Expected Behavior: Not prompting for MFA on every single sign-in is an intentional design by Microsoft to balance security with user convenience.

Solution 2

Revoke Active Tokens to Force Authentication

Invalidate current user sessions to require them to authenticate again and trigger the MFA registration prompt.

Solution 3

Create a Support Request with Microsoft

Contact Microsoft support if users still bypass MFA after 14 days and token revocation.

Free Microsoft Office alternative

Maintain Productivity with WPS Office

Dealing with backend security policies and MFA configurations in Microsoft environments can be time-consuming. Keep your organization's document workflows running smoothly with WPS Office—a lightweight, highly compatible alternative to Microsoft Office.

1. Visit the WPS Office Website: Go to the official WPS Office website to access the latest secure installation files.
2. Download the Installer: Click the 'Free Download' button to get the lightweight installer tailored for your device.
3. Install and Work: Run the installer. Once completed, you can immediately open, edit, and save your existing Office documents.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsLightweight software that runs efficiently on Windows, Mac, Linux, and mobile OSFree to use with a familiar user interface, requiring zero learning curve for seamless migration

microsoft office alternative - wps office

Frequently Asked Questions

What is the 14-day grace period in Microsoft Entra Security Defaults?

When Security Defaults are enabled, Microsoft Entra grants users a 14-day window starting from their first interactive sign-in. During this time, they can skip MFA registration to ensure their immediate workflow isn't blocked. Once the 14 days expire, registration becomes mandatory.

Why isn't MFA requested on every single browser sign-in?

Security Defaults are designed to balance security with user friction. Instead of prompting on every sign-in, Microsoft evaluates the risk level and the access scenario. Users are primarily challenged for MFA when they access resources that are considered sensitive.

How can I force an MFA prompt immediately for a specific user?

An administrator can go into the Microsoft Entra admin center, select the user's profile, and click 'Revoke sessions'. This invalidates all active tokens, forcing the user to sign in again and triggering the MFA setup prompt.

Can I disable the 14-day grace period in Security Defaults?

No, the 14-day grace period cannot be modified or disabled if you are strictly using Security Defaults. To have granular control over MFA registration timelines and conditions, you must use Microsoft Entra Conditional Access policies instead of Security Defaults.

Microsoft Office Security Issues