MFA Security Issues

How to Manage Multifactor Authentication for Disabled Users in Microsoft Entra

Maira Mehtab Sep 22, 2026 869 views

Question details

Administrators need to effectively manage multifactor authentication (MFA) policies when disabled user accounts and shared mailboxes appear alongside active users in the directory.

Product: Microsoft Entra
Device & OS: not provided
Scenario: Reviewing and managing multifactor authentication statuses in an organization's directory that retains non-signing accounts for operational purposes.
Observed behavior: The Microsoft Entra MFA portal displays disabled user accounts and shared mailboxes that cannot sign in, making the bulk selection process complex and status information unreliable.

Before you start

Ensure you are signed in to the Microsoft Entra admin center with at least Authentication Administrator or Global Administrator privileges before modifying authentication policies.

Solution 1Recommended

Use Microsoft Entra Conditional Access

For consistent and large-scale deployments, Conditional Access policies provide a more reliable way to enforce MFA than managing users individually in the portal.

Conditional Access allows administrators to create automated policies that evaluate sign-in signals. By using these policies, you can systematically require MFA for active users while safely ignoring disabled accounts and shared mailboxes that do not require interactive sign-in.

Access Conditional Access

Create a New Policy

Click on 'Create new policy' and assign it a descriptive name, such as 'Require MFA for Active Users'.

Configure User Assignments

Under 'Users', explicitly include the necessary user groups and use the 'Exclude' tab to filter out shared mailboxes or specific operational accounts.

Enforce MFA

Under 'Grant' controls, select 'Require multifactor authentication', then enable and save your policy.

Best Practice: Microsoft recommends Conditional Access as the primary method for deploying MFA in modern Entra environments.

Solution 2

Manually Review and Enable MFA

If your organization has fewer than 100 users, manually reviewing accounts can be a practical workaround when the portal displays disabled users.

Solution 3

Automate Management Using PowerShell

PowerShell scripts can filter out disabled accounts programmatically, bypassing the complexities of the web portal interface.

Free Microsoft Office alternative

Need a Lightweight and Free Office Suite?

While you manage advanced IT infrastructure and Microsoft Entra security policies, ensure your daily documentation tasks remain simple and efficient. WPS Office is a powerful, free alternative to Microsoft Office that loads quickly, features a highly familiar interface, and fulfills all your document creation needs without heavy subscription costs.

1. Visit the Website: Go to the official WPS Office website on your computer.
2. Download the Installer: Click the 'Free Download' button to get the latest installation package.
3. Install and Launch: Run the downloaded file to install WPS Office and instantly open your existing Microsoft Office documents.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsLightweight application that loads fast and consumes minimal system resourcesSeamless document editing across Windows, Mac, Linux, and mobile devicesFree to use with a familiar, easy-to-navigate user interface

Frequently Asked Questions

Why do disabled user accounts appear in the Microsoft Entra MFA portal?

Disabled user accounts and shared mailboxes often remain in the active directory for operational purposes, such as retaining access to historical emails or compliance data. The default MFA management view does not automatically hide these accounts.

Should I enable multifactor authentication for a shared mailbox?

No. Shared mailboxes generally do not require, and cannot support, interactive sign-in credentials. Instead of enabling MFA on the shared mailbox itself, you should enforce MFA on the active user accounts that have permission to access the shared mailbox.

What is the best way to handle MFA if bulk selection in the portal is unreliable?

If you experience unreliability with bulk selection or status tracking in the manual MFA portal, the best practice is to transition to Microsoft Entra Conditional Access policies, or use official PowerShell scripts to automate the filtering and enforcement process.

Microsoft Office Security Issues