Conditional Access Problems

How to Require Existing MFA Registration Before Microsoft Entra Sign-In

Chanuka Geekiyanage Oct 14, 2026 870 views

Question details

Users without registered MFA are being allowed to register during sign-in instead of being blocked by Conditional Access.

How to Require Existing MFA Registration Before Microsoft Entra Sign-In

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: Configuring Conditional Access policies to enforce pre-registered multifactor authentication.
Observed behavior: The Conditional Access policy requires MFA, but unregistered users are prompted to register rather than being denied access.

Before you start

Ensure you have Conditional Access Administrator or Global Administrator privileges in your Microsoft Entra tenant, and confirm you have excluded emergency access (break-glass) accounts to prevent accidental lockouts.

Solution 1Recommended

Configure Conditional Access and Registration Policies

Adjust your Microsoft Entra ID Conditional Access policies to restrict MFA registration and block access if pre-existing authentication conditions are not met.

By default, Microsoft Entra ID prompts users to register for MFA if a policy requires it and they have not yet registered. To require existing MFA registration before sign-in, you must separate the MFA registration process from standard access and apply strict controls.

Access Microsoft Entra admin center

Review Registration Campaigns

Navigate to Protection > Authentication methods > Registration campaign. Verify whether policies are actively prompting users to set up authentication methods during standard sign-in, and adjust the state to 'Disabled' if you wish to stop this behavior.

Restrict Security Information Registration

Go to Protection > Conditional Access > Policies. Create a new policy targeting the 'Register security information' user action. Configure this policy to require registration only from trusted networks or compliant devices, preventing users from registering from untrusted locations.

Apply Access Policies

Ensure your standard Conditional Access policies require multifactor authentication for target cloud apps. If a user attempts to access these apps from an untrusted location without pre-registered MFA, they will be blocked because they cannot fulfill the MFA requirement nor register for it on the spot.

Exclude Emergency Accounts

Under the 'Users' assignment of your restrictive policies, select 'Exclude' and add your emergency access accounts to ensure you do not lose access to your tenant.

Configure Conditional Access and Registration Policies

Licensing Constraints: Advanced Conditional Access controls require Microsoft Entra ID P1 or P2 licenses. Check your current licensing tier to verify these capabilities are available.

Free Microsoft Office alternative

Manage Your IT Documentation with WPS Office

While Microsoft Entra ID handles your identity and security policies, documenting these configurations is essential for IT administration. WPS Office is a free, lightweight, and powerful alternative to Microsoft Office, perfectly suited for creating security reports, policy spreadsheets, and infrastructure presentations.

1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install WPS Office: Run the setup file and follow the quick installation prompts to set up the suite on your device.
3. Open and Edit IT Documents: Launch WPS Office to instantly open, edit, and share your existing Microsoft Office IT policy documents seamlessly.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsLightweight and fast, perfect for IT professionals managing multiple system tasksFamiliar tabbed user interface that requires zero learning curveFree to use for daily administrative documentation and reporting needs

microsoft office alternative - wps office

Frequently Asked Questions

Why are users prompted to register for MFA instead of being blocked?

By default, if a Conditional Access policy requires MFA and the user hasn't registered, Microsoft Entra ID interrupts the sign-in process to prompt them for registration. This is designed to prevent immediate lockouts for un-enrolled users.

Can I block MFA registration from outside my corporate network?

Yes. You can create a Conditional Access policy targeting the 'Register security information' user action and set the condition to block access unless the user is connecting from a designated trusted IP location.

What role do I need to manage Conditional Access policies?

You must be assigned the Conditional Access Administrator, Security Administrator, or Global Administrator role in Microsoft Entra ID to create or modify these policies.

Microsoft Office Security Issues