MFA Security Issues

How to Stop Microsoft Authenticator Prompts and Configure SMS MFA

Huma Ashraf Ch Sep 30, 2026 869 views

Question details

The organization needs to stop Microsoft from forcing the Authenticator app and instead configure SMS MFA or shared password-manager OTPs for its users.

How to Stop Microsoft Authenticator Prompts and Configure SMS MFA

Product: Microsoft Entra ID (Office 365)
Device & OS: not provided
Scenario: Managing multi-factor authentication (MFA) preferences for organizational, shared, or older accounts during Microsoft sign-in.
Observed behavior: Users and older accounts are experiencing forced sign-in loops to register the Microsoft Authenticator app, overriding the organization's preference for SMS MFA.

Before you start

Ensure you have Global Administrator or Authentication Policy Administrator privileges in the Microsoft Entra admin center to modify security defaults and authentication campaigns.

Solution 1Recommended

Disable Microsoft Authenticator Registration Campaign

Turn off the aggressive registration campaign that pushes users to set up the Authenticator app during sign-in.

Microsoft Entra ID uses a default registration campaign to nudge users toward the Authenticator app. Disabling this campaign stops the persistent prompts for users who are already using SMS or other configured MFA methods.

Access Microsoft Entra Admin Center

Navigate to Registration Campaign

Click on 'Authentication methods' and then select 'Registration campaign' from the available policies.

Disable the Campaign

Click on 'Edit', change the State dropdown to 'Disabled', and save your changes to immediately stop the Authenticator prompts.

Disable Microsoft Authenticator Registration Campaign

Security Note: Disabling the registration campaign stops the prompts but may impact your organization's zero-trust security posture. Ensure this change complies with your internal IT security policies.

Solution 2

Enable SMS and OATH Tokens in Authentication Methods

Explicitly enable SMS and third-party software OATH tokens (like password managers) for your users.

Solution 3

Adjust Security Defaults and Conditional Access

Use Conditional Access to granularly control MFA requirements and exclude shared or legacy accounts experiencing sign-in loops.

Free Microsoft Office alternative

Switch to WPS Office for a Hassle-Free Offline Experience

Dealing with strict Microsoft Office 365 cloud administrative policies and forced multi-factor authentication prompts can severely slow down your team's workflow. WPS Office provides a free, lightweight, and highly compatible alternative for document creation and editing that does not force mandatory cloud logins or complex Entra ID configurations.

1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install WPS Office: Run the downloaded executable file and follow the quick installation wizard to set up the suite on your device.
3. Open and Edit Instantly: Launch WPS Office to immediately open your existing Microsoft Office files and start working without dealing with mandatory sign-in loops.

Operates efficiently without requiring complex Entra ID MFA configurations for local document editing.Fully compatible with all standard Microsoft Office formats, including Word (.docx), Excel (.xlsx), and PowerPoint (.pptx).Lightweight software architecture ensuring fast startup times on older and newer devices.Seamlessly migrate and edit your existing Microsoft documents with zero formatting loss.

microsoft office alternative - wps office

Frequently Asked Questions

Why does Microsoft keep prompting for Authenticator when I selected SMS?

Microsoft enables a 'Registration campaign' by default in Entra ID (formerly Azure AD) designed to nudge users toward more secure MFA methods like the Microsoft Authenticator app. You must explicitly disable this campaign in the Authentication methods settings to stop the continuous prompts.

Can I use a password manager for MFA on shared administrator accounts?

Yes. By enabling 'Third-party software OATH tokens' in the Entra ID Authentication methods policy, you can generate time-based OTPs directly inside enterprise password managers for shared accounts, bypassing the need to link a personal smartphone.

How do I stop the MFA sign-in loop for older legacy accounts?

Sign-in loops on older accounts usually happen due to a conflict between legacy per-user MFA settings and modern Security Defaults or Conditional Access. To fix this, disable the legacy per-user MFA status for those accounts and manage their authentication enforcement purely through Conditional Access policies with proper group exclusions.

Microsoft Office Security Issues