MFA Security Issues

How to Bypass MFA for Password Changes in Microsoft Entra ID

Tauseeq Magsi Oct 10, 2026 869 views

Question details

The organization needs a way to prevent Multifactor Authentication (MFA) prompts specifically during password changes while keeping MFA active for other actions via Conditional Access.

Can Multifactor Authentication Be Bypassed Only for Password Changes?

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: Managing secure password resets in a restricted workplace environment where employees are not permitted to carry mobile phones.
Observed behavior: The system prompts for MFA during password changes, which prevents users from completing the process since they cannot use mobile devices to authenticate at work.

Before you start

Ensure you are logged into the Microsoft Entra admin center with Global Administrator or Conditional Access Administrator privileges before modifying authentication policies.

Solution 1Recommended

Configure Trusted Locations in Conditional Access Policies

Use a narrowly scoped Conditional Access policy to exclude users from MFA prompts during password changes only when they are on a trusted corporate network.

Broadly disabling MFA is not recommended and can compromise organizational security. Instead, Microsoft recommends defining your secure workplace as a 'Trusted Location'.

By doing this, you can create a Conditional Access policy that requires MFA for password changes globally but excludes requests originating from your trusted corporate IP addresses.

Define a Trusted Location

Sign in to the Microsoft Entra admin center. Go to Protection > Conditional Access > Named locations. Add your corporate network's public IP address ranges and mark them as a trusted location.

Create or Edit a Conditional Access Policy

Navigate to Protection > Conditional Access > Policies. Create a new policy targeting the specific users who cannot use mobile phones.

Target the Password Change Action

Under 'Target resources', select 'User actions' and check 'Register security information' or the relevant password reset action.

Exclude the Trusted Location

Under 'Conditions' > 'Locations', include 'Any location' but explicitly exclude 'All trusted locations'. Ensure the Access controls are set to require MFA, meaning MFA will only be prompted outside the trusted network.

Configure Trusted Locations in Conditional Access Policies

Microsoft Q&A Support: For highly specific tenant configurations, it is highly recommended to consult the Microsoft Q&A community for Azure Cloud Services.

Solution 2

Implement Hardware-Based Authentication Methods

Provide alternative authentication methods that comply with security requirements when mobile phones are banned from the workspace.

Free Microsoft Office alternative

Need a Secure and Lightweight Office Suite? Try WPS Office

While managing complex enterprise IT policies and Entra ID security, ensure your end-users have access to a reliable, lightweight, and highly compatible office suite. WPS Office provides excellent performance and seamless compatibility with Microsoft Office formats, making it an ideal choice for businesses.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the setup file and follow the on-screen instructions to deploy the software on your computer.
3. Open Your Documents: Launch WPS Office and open your existing Microsoft Office files to edit them seamlessly.

Native compatibility with Microsoft Word, Excel, and PowerPoint formatsLightweight application that runs smoothly on standard enterprise hardwareEnterprise-friendly interface for seamless user adoption without retrainingAdvanced document encryption and built-in password protection features

Frequently Asked Questions

Why does Microsoft Entra ID enforce MFA for password changes by default?

Password changes and security info registrations are considered high-risk actions. Microsoft enforces MFA to ensure that an attacker who compromises a user's password cannot easily change the password or register their own authentication device to lock the legitimate user out.

Can I use FIDO2 security keys instead of the Microsoft Authenticator app?

Yes. FIDO2 security keys are a fully approved, passwordless authentication method in Microsoft Entra ID. They are highly recommended for secure environments where employees are not permitted to carry mobile phones.

Is it safe to disable MFA completely for specific users?

Broadly disabling MFA is strongly discouraged as it significantly increases the risk of account compromise. Instead of disabling it, administrators should use narrowly scoped Conditional Access policies or alternative hardware authentication methods.

Microsoft Office Security Issues