MFA Security Issues

How to Bypass MFA for Scan-to-Email with Entra Security Defaults

Chanuka Geekiyanage Oct 21, 2026 868 views

Question details

The user needs to know if it is possible to exclude a scan-to-email or multi-function printer account from Multifactor Authentication (MFA) requirements while Microsoft Entra Security Defaults are turned on.

How to Bypass MFA for Scan-to-Email with Entra Security Defaults

Product: Microsoft Entra / Microsoft 365
Device & OS: not provided
Scenario: Setting up a network scanner or automated application to send emails using a Microsoft 365 account that is currently blocked by mandatory MFA prompts.
Observed behavior: The scanner account fails to authenticate and send emails because it cannot interactively complete the MFA challenge required by Microsoft Entra Security Defaults.

Before you start

Ensure you have Global Administrator privileges in your Microsoft Entra ID tenant and verify if your organization holds Microsoft Entra ID P1 or P2 licenses, which are required for configuring Conditional Access.

Solution 1Recommended

Switch from Security Defaults to Conditional Access Policies

Because Security Defaults enforce MFA tenant-wide without exception, you must disable them and recreate your security baseline using Conditional Access to exclude specific scanner accounts.

Microsoft Entra Security Defaults are designed as a rigid, all-or-nothing security baseline. They do not support granular exclusions for specific users or service accounts. To achieve this, you must upgrade to Conditional Access, which requires premium licensing but offers precise control.

Access Microsoft Entra Properties

Disable Security Defaults

Scroll to the bottom of the Properties page and click on 'Manage security defaults'. Change the toggle for 'Enable security defaults' to 'Disabled (not recommended)' and click Save.

Create a Conditional Access Policy

Navigate to Protection > Conditional Access. Click 'Create new policy' and name it appropriately (e.g., 'Enforce MFA for All Users').

Exclude the Scanner Account

Under 'Users', select 'All users' for inclusion. Then, click the 'Exclude' tab, check 'Users and groups', and select your specific scan-to-email account to bypass the policy.

Enforce MFA and Save

Under 'Grant', select 'Require multifactor authentication'. Finally, set the policy state to 'On' and click 'Create' to apply the changes.

Switch from Security Defaults to Conditional Access Policies

Security Best Practice: When excluding an account from MFA, ensure it has a highly complex password. You should also create an additional Conditional Access policy to restrict this account's sign-ins solely to your office's trusted public IP address.

Solution 2

Use Microsoft 365 Direct Send (No MFA Required)

If you cannot disable Security Defaults or lack premium licenses, configure your scanner to use Direct Send, which authenticates via IP address instead of a username and password.

Free Microsoft Office alternative

Simplify Your Workflow with WPS Office

While managing complex Microsoft 365 administration and MFA policies can be tedious, your daily document tasks shouldn't be. WPS Office offers a powerful, lightweight alternative to Microsoft Office that doesn't require complex tenant configurations.

Seamless format compatibility with Microsoft Word, Excel, and PowerPoint.No complex administrative setups or mandatory MFA lockouts for local document editing.Lightweight application with a familiar interface for zero learning curve.Completely free to download and use for your essential productivity needs.

microsoft office alternative - wps office

Frequently Asked Questions

Why can't I just exclude one user in Microsoft Entra Security Defaults?

Security Defaults are intended to provide a strict, all-or-nothing security baseline to protect entire organizations automatically. Microsoft intentionally omits granular exclusions from Security Defaults to prevent accidental security vulnerabilities.

What licenses do I need to use Conditional Access instead of Security Defaults?

To utilize Conditional Access policies for MFA exclusions, your organization must have Microsoft Entra ID P1 or P2 licenses (formerly Azure AD Premium P1/P2). These are often included in bundles like Microsoft 365 Business Premium, E3, or E5.

Can I use App Passwords to bypass MFA for my scanner?

If Security Defaults are enabled, legacy App Passwords are disabled by default. Additionally, Microsoft is actively deprecating basic authentication, making App Passwords an unreliable long-term solution for scan-to-email services.

Is it safe to disable Security Defaults?

Disabling Security Defaults is only safe if you immediately replace them with comprehensive Conditional Access policies. Leaving your tenant without any MFA enforcement leaves your organization highly vulnerable to identity attacks.

Microsoft Office Security Issues