Security Policy Errors

How to Disable Microsoft 365 Security Defaults and MFA Prompts

Elise Williams Oct 21, 2026 869 views

Question details

Administrators and organizations need a way to stop Microsoft 365 from forcing employees to use the Microsoft Authenticator app or multi-factor authentication (MFA) within a 14-day grace period.

How to Disable Microsoft 365 Security Defaults and MFA Prompts

Product: Microsoft 365 / Azure Active Directory
Device & OS: not provided
Scenario: Employees are unexpectedly prompted to set up MFA or the Microsoft Authenticator app when signing into their work accounts.
Observed behavior: Users encounter mandatory MFA registration prompts during login, blocking access to their accounts if not completed, even if the company prefers not to enforce MFA for every employee.

Before you start

Ensure you have Global Administrator, Security Administrator, or Conditional Access Administrator privileges in your Microsoft 365 tenant. Be aware that disabling these defaults removes baseline identity protections from your organization's environment.

Solution 1Recommended

Disable Security Defaults in the Azure Portal

Toggle off the tenant-wide security defaults in Microsoft Entra ID (formerly Azure AD) to immediately stop automatic MFA enforcement for all users.

Microsoft enables Security Defaults on new and existing tenants to improve baseline security. If your organization relies on legacy authentication or prefers not to enforce MFA company-wide, you can turn this feature off via the Azure portal.

Sign in to the Azure Portal

Open your web browser and sign in to the Azure portal (portal.azure.com) using an account with Global Administrator or Security Administrator permissions.

Navigate to Properties

From the left-hand menu, select 'Azure Active Directory' (now called Microsoft Entra ID). In the overview page, scroll down the left navigation pane and click on 'Properties'.

Manage Security Defaults

Scroll to the bottom of the Properties page and click the link that says 'Manage security defaults'.

Disable and Save

A side panel will open. Change the 'Enable security defaults' toggle (or dropdown) from Yes to No (Disabled). Select a reason for disabling if prompted, then click 'Save' at the bottom.

Disable Security Defaults in the Azure Portal

Security Risk Warning: Disabling security defaults removes critical protections against identity-related attacks. It is highly recommended to configure Conditional Access policies instead if you need granular MFA control for specific groups.

Solution 2

Review Conditional Access Policies and Per-User MFA

If security defaults are already disabled but certain users still receive MFA prompts, you need to check for conflicting administrative policies.

Free Microsoft Office alternative

Switch to WPS Office for a Hassle-Free Desktop Experience

If Microsoft 365's complex administrative policies, cloud dependencies, and mandatory MFA enforcements are causing friction for your team, consider switching to WPS Office. It provides a robust, locally installable office suite without forcing complex cloud authentication apps on your employees.

1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install the Software: Run the setup file and follow the straightforward on-screen instructions to install the suite on your computer.
3. Edit Offline Without Friction: Open WPS Office and instantly start working on your local documents without dealing with complex tenant-wide MFA policies or cloud sign-in prompts.

Highly compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).No mandatory cloud security defaults or forced MFA apps required for local document editing.Lightweight and easy to deploy across Windows, macOS, and Linux.Familiar user interface requires zero learning curve, allowing for a seamless migration.

microsoft office alternative - wps office

Frequently Asked Questions

Why are my users suddenly being forced to use the Microsoft Authenticator app?

Microsoft periodically turns on Security Defaults for existing tenants to enhance security. This tenant-wide policy automatically requires all users to register for MFA using the Microsoft Authenticator app within 14 days of their next sign-in.

Can I disable MFA for just one specific user while keeping Security Defaults enabled?

No. Security Defaults is an all-or-nothing, tenant-wide setting. To apply MFA to specific users while excluding others, you must disable Security Defaults and configure Conditional Access policies, which requires an Azure AD Premium P1 or P2 license.

What happens if users ignore the 14-day MFA setup prompt?

Once the 14-day grace period expires, users will be locked out of their Microsoft 365 accounts. They will not be able to bypass the sign-in screen until they successfully complete the multi-factor authentication registration.

Microsoft Office Security Issues