MFA Security Issues

How to Fix Azure AD MFA Prompting When Status is Disabled

Huda Qurayshi Oct 22, 2026 869 views

Question details

Users are receiving Multi-Factor Authentication (MFA) prompts even though their MFA status is set to Disabled in the portal.

Fix Azure AD MFA Prompting When Status is Disabled

Product: Azure Active Directory (Microsoft Entra ID)
Device & OS: not provided
Scenario: Managing user authentication policies and troubleshooting unexpected login prompts in an Azure AD or hybrid environment.
Observed behavior: MFA prompts continue to appear during user sign-in despite the per-user MFA status explicitly showing as disabled in the Azure portal.

Before you start

Ensure you have Global Administrator or Security Administrator privileges in your Microsoft tenant to review Conditional Access policies and tenant-wide security defaults.

Solution 1Recommended

Review Conditional Access Policies and Security Defaults

Per-user MFA status does not override tenant-wide security defaults or Conditional Access policies that mandate MFA.

In modern Azure AD (Microsoft Entra ID) environments, the legacy per-user MFA portal status does not reflect all authentication requirements. If your organization uses Security Defaults or Conditional Access, users will still be prompted for MFA regardless of their per-user status being set to 'Disabled'.

Access Azure Active Directory Security Settings

Log in to the Azure Portal or Microsoft Entra admin center as an administrator. Navigate to 'Azure Active Directory' (or Microsoft Entra ID) and select 'Security' from the left-hand navigation pane.

Check Security Defaults

Under the 'Properties' tab of your Azure AD overview, check the 'Manage security defaults' link at the bottom. If Security Defaults are enabled, all users are required to register and use MFA. Disable it only if you are replacing it with Conditional Access policies.

Review Conditional Access Policies

In the Security menu, click on 'Conditional Access'. Review any active policies that target all users or specific groups and have 'Require multi-factor authentication' selected under the Access controls section. You may need to add an exclusion for the affected user if they genuinely should not be prompted.

Microsoft Entra ID Updates: Microsoft is continuously updating the Azure portal interface. If you cannot find 'Security', look for 'Protection' or 'Conditional Access' directly via the top search bar in the Microsoft Entra admin center.

Solution 2

Investigate Hybrid Identity and Synchronization Issues

Identify if on-premises Active Directory settings or delayed synchronization are causing MFA status mismatches.

Free Microsoft Office alternative

Switch to WPS Office for a Hassle-Free Productivity Experience

If managing complex Microsoft 365 administration features like Azure AD MFA is creating overhead for your small business or personal workflow, consider switching to WPS Office. It provides a lightweight, easy-to-use, and highly compatible office suite for all your document needs without the burden of enterprise IT management.

1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install WPS Office: Run the downloaded installer file and follow the simple on-screen instructions to set up the software.
3. Open Your Microsoft Files: Launch WPS Office and directly open your existing .docx, .xlsx, and .pptx files with perfect formatting compatibility.

Free and lightweight Office alternative that installs in secondsFully compatible with Microsoft Word, Excel, and PowerPoint formatsNo complex Azure AD or MFA configuration required for standard local useFamiliar user interface ensuring a seamless transition for your team

microsoft office alternative - wps office

Frequently Asked Questions

Why does Azure AD show my MFA as disabled but still prompts me?

The per-user MFA status page only shows legacy MFA settings. If your organization has enabled tenant-wide Security Defaults, Conditional Access policies, or Identity Protection policies, those modern settings will override the legacy disabled status and force MFA prompts.

How do I completely bypass MFA for a specific Azure AD user?

You must set their per-user MFA status to 'Disabled' AND exclude their account from any active Conditional Access policies or Identity Protection policies that enforce MFA. Note that if 'Security Defaults' are enabled for the whole tenant, you cannot easily exclude individual users.

Where can I find Conditional Access policies in the Azure Portal?

Sign in to the Microsoft Entra admin center or Azure Portal. Go to Microsoft Entra ID (formerly Azure Active Directory), select 'Security' from the left navigation menu, and then click on 'Conditional Access' to view and manage policies.

Do hybrid environments affect Microsoft 365 MFA status?

Yes. In hybrid setups utilizing ADFS or complex Azure AD Connect configurations, on-premises authentication requirements can sometimes trigger MFA prompts even if the cloud-side per-user MFA toggle is set to disabled.

Microsoft Office Security Issues