How to Get Alerts When Microsoft 365 MFA is Disabled
Question details
Administrators need a way to be notified when Multifactor Authentication (MFA) is turned off for any user account.
- Product
- Microsoft 365 / Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Tracking administrative changes to user security settings to ensure continued account protection and compliance.
- Observed behavior
- When an administrator disables MFA for a user, Microsoft 365 and Microsoft Entra ID do not automatically send notifications to other administrators.
Ensure you have the necessary administrative privileges, such as Global Administrator or Security Administrator, in the Microsoft 365 admin center or Microsoft Purview to access audit logs and configure alerting policies.
Configure Alert Policies Using Audit Logs
Create custom alert policies in the Microsoft Purview compliance portal to automatically trigger notifications whenever an administrator changes MFA settings.
Since Microsoft 365 does not provide out-of-the-box alerts for MFA deactivation, the most reliable method for automated detection is configuring a custom alert policy based on audit log activities.
Log in to the Microsoft Purview compliance portal using your administrator credentials.
On the left navigation pane, click on 'Policies' and select 'Alert policies'.
Click 'New alert policy'. Give the policy a name, such as 'MFA Disabled Alert', and set the severity level.
Under the 'Create alert settings' section, select the activity that corresponds to disabling Multifactor Authentication or updating user security info.
Specify the email addresses of the administrators who should receive the alert notifications, then review and save the policy.
Regularly Review MFA Status Manually
Periodically check the active MFA status of users manually in the admin center if automated alerts are not feasible or configured.
Looking for a Secure and Lightweight Office Suite?
While you manage your organization's IT security policies, you might also be looking for a cost-effective office productivity solution. WPS Office is a highly compatible, free alternative to Microsoft Office that supports all major document formats with a user-friendly interface.
- 1. Download the Installer: Visit the official WPS Office website to download the free installation package for your operating system.
- 2. Install WPS Office: Run the downloaded installer and follow the simple on-screen instructions to set up the software.
- 3. Open Your Documents: Launch WPS Office to instantly open, edit, and save your existing Microsoft Office files without any format loss.
Frequently Asked Questions
Why doesn't Microsoft 365 send MFA disabled alerts by default?
Microsoft 365 handles MFA configuration as a routine administrative task. To prevent alert fatigue from frequent administrative changes, automated notifications for disabling MFA are not enabled by default and must be explicitly configured via audit log policies.
Can I use PowerShell to check which users have MFA disabled?
Yes, administrators can use the Microsoft Graph PowerShell module to query the authentication methods of users and generate a comprehensive report of accounts that do not have MFA enforced or registered.
Are audit logs required to create MFA alerts?
Yes, to trigger customized alerts for administrative actions like disabling MFA, auditing must be turned on in the Microsoft Purview compliance portal so the system can track and report the events.
