'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Disable MFA for an Entire Microsoft Entra Tenant
Question details
The administrator needs to temporarily disable multifactor authentication (MFA) across an entire Microsoft Entra tenant for a migration process.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Performing a temporary migration or system setup that requires tenant-wide MFA to be temporarily turned off.
- Observed behavior
- Security defaults enforce MFA for all users, blocking automated migration scripts or legacy authentication setups.
Ensure you have global administrator privileges in the Microsoft Entra admin center. Disabling tenant-wide MFA significantly reduces security, so plan to re-enable it immediately after your migration is complete.
Disable Security Defaults in Microsoft Entra Admin Center
This solution turns off the baseline security defaults, effectively disabling tenant-wide MFA. Use this only temporarily during migrations.
Microsoft Entra ID enforces multifactor authentication for all users by default to protect the tenant. Disabling this feature reduces security and should be limited to necessary situations, such as large-scale automated migrations.
Log in to the Microsoft Entra admin center using an account with Global Administrator permissions.
Go to 'Microsoft Entra ID' in the left navigation menu, click on 'Overview', and then select 'Properties'.
Scroll to the bottom of the Properties page and click the 'Manage security defaults' link.
In the 'Security defaults' side panel, change the setting to 'Disabled'. Select a reason for disabling from the dropdown prompt and click 'Save'.
Equip Your Tenant Users with WPS Office
If you are migrating users across Microsoft Entra tenants or seeking a cost-effective productivity suite, WPS Office provides a lightweight, highly compatible alternative to Microsoft Office. It helps organizations save on licensing costs while ensuring seamless document workflows.
- 1. Download WPS Office: Visit the official WPS Office website to download the free installer for your organization.
- 2. Install and Deploy: Run the lightweight installer on your users' devices, or deploy via standard IT management tools.
- 3. Open and Edit Seamlessly: Users can instantly open their existing Microsoft Office files without any formatting loss or steep learning curves.
Frequently Asked Questions
Is it safe to disable MFA for the entire tenant?
Disabling MFA tenant-wide is not recommended for standard operations as it leaves your organization vulnerable to credential attacks. It should only be done temporarily during specific migrations and re-enabled as soon as possible.
Can I disable MFA for specific users instead of the whole tenant?
Yes, if you have Microsoft Entra ID P1 or P2 licenses, it is highly recommended to use Conditional Access policies to exclude specific users or groups from MFA rather than disabling security defaults entirely.
Why is the 'Manage security defaults' option grayed out?
The option might be unavailable if you do not have the required Global Administrator permissions, or if your tenant has Conditional Access policies actively enabled that conflict with security defaults.
Do I need a premium license to disable security defaults?
No, security defaults are available and can be managed in the free tier of Microsoft Entra ID. However, advanced granular MFA controls (like excluding specific accounts) require a premium license.
