How to Disable Microsoft Authenticator Prompts for an Organization
Question details
Users within an organization continue to receive Microsoft Authenticator setup and approval prompts even after multifactor authentication (MFA) appears to have been disabled.
- Product
- Microsoft 365 / Entra ID
- Device & OS
- not provided
- Scenario
- Administrators are trying to disable MFA or specifically the Microsoft Authenticator requirement for their tenant's users.
- Observed behavior
- The Microsoft Authenticator app continues to prompt users for authentication or setup during sign-in despite organizational attempts to turn off MFA.
Ensure you have Global Administrator or Security Administrator privileges in your Microsoft Entra ID (formerly Azure AD) tenant before modifying organizational authentication policies.
Review Entra ID Security Defaults and Conditional Access Policies
Tenant-wide Security Defaults or Conditional Access policies may override individual user MFA settings, causing continuous Authenticator prompts.
Microsoft automatically enables Security Defaults for many tenants, which mandates the use of the Microsoft Authenticator app. If your organization relies on custom access rules, you may need to disable Security Defaults and check your Conditional Access policies.
Log in to the Microsoft Entra admin center. Navigate to 'Identity' > 'Overview' > 'Properties' and click 'Manage security defaults'. Set it to 'Disabled' if you intend to manage security manually.
Go to 'Protection' > 'Conditional Access' in the left-hand navigation menu.
Look for active policies that require multifactor authentication or specifically mandate strong authentication strengths. Modify or disable these policies for the affected user groups.
Disable Per-User MFA and Registration Campaigns
Legacy per-user MFA settings or Microsoft's nudge campaigns might force users to set up the Authenticator app even if tenant policies are relaxed.
Boost Organizational Productivity with WPS Office
While managing complex tenant settings and MFA policies in Microsoft environments, you can simplify your team's day-to-day document tasks with WPS Office. It provides a lightweight, comprehensive productivity suite that seamlessly handles Word, Excel, and PowerPoint files without complex backend administration.
- 1. Download the Installer: Visit the official WPS Office website and click 'Free Download' to get the installer for your preferred operating system.
- 2. Install WPS Office: Run the downloaded setup file and follow the quick on-screen instructions to install the suite on your device.
- 3. Start Creating: Open WPS Office to instantly access Writer, Spreadsheets, Presentation, and PDF tools from a single, unified dashboard.
Frequently Asked Questions
Why are users still prompted for Authenticator after I disabled per-user MFA?
Even if legacy per-user MFA is set to 'Disabled', tenant-level settings like Microsoft Entra Security Defaults or active Conditional Access policies will override individual settings and enforce multifactor authentication.
Can I disable the Microsoft Authenticator app but keep SMS authentication?
Yes. In the Microsoft Entra admin center, navigate to Protection > Authentication methods > Policies. From there, you can disable the Microsoft Authenticator method entirely while leaving other methods like SMS or Voice enabled.
What is a registration campaign in Microsoft 365?
A registration campaign is an administrative feature that actively prompts and nudges users to set up higher-security authentication methods (like the Microsoft Authenticator app) during their regular sign-in flow.
How do I remove obsolete Authenticator app registrations for a user?
Go to the Entra admin center, search for the specific user, and navigate to their 'Authentication methods' blade. From there, you can view and revoke or delete old Microsoft Authenticator device registrations.
