MFA Security Issues

How to Stop Microsoft Authenticator Prompts for Desk-Phone MFA Users

Elise Williams Oct 12, 2026 868 views

Question details

Administrators need to stop users from being prompted to register for the Microsoft Authenticator app when the organization relies on desk-phone MFA or other approved methods.

How to Stop Microsoft Authenticator Prompts for Desk-Phone MFA Users

Product: Microsoft 365
Device & OS: not provided
Scenario: Users are being forced to register for Microsoft Authenticator despite having desk-phone authentication as their designated MFA method.
Observed behavior: Microsoft 365 repeatedly prompts users to set up the Microsoft Authenticator app during login, interrupting their workflow and overriding their existing phone-based MFA setup.

Before you start

Ensure you are logged in with Global Administrator or Authentication Policy Administrator privileges in the Microsoft Entra admin center before modifying organization-wide MFA policies.

Solution 1Recommended

Exclude Affected Users from the Registration Campaign

Modify the Microsoft Entra Registration campaign settings to bypass the Authenticator prompt for specific users or groups.

Microsoft uses a default registration campaign to encourage users to set up the Authenticator app. Excluding specific desk-phone users from this campaign prevents the prompt while keeping MFA active.

Access Authentication Methods

Log in to the Microsoft Entra admin center. In the left navigation pane, expand 'Protection' and select 'Authentication methods'.

Open Registration Campaign Settings

Under the Authentication methods menu, click on 'Registration campaign' to view the current Microsoft Authenticator nudge settings.

Edit the Campaign

Click the 'Edit' button to modify the state and targeting of the campaign.

Exclude Desk-Phone Users

Scroll down to the 'Excluded' section. Click 'Add users and groups', search for the specific users or the group containing your desk-phone users, and select them.

Save Changes

Click 'Save' at the bottom of the screen to apply the new exclusions. The excluded users will no longer receive the prompt.

Exclude Affected Users from the Registration Campaign

Maintain Security Standards: Ensure that the excluded users still have an approved alternative MFA method (such as voice call) configured so their accounts remain fully secured.

Solution 2

Review Authentication Method Policies

Verify that alternative MFA methods like voice calls are properly enabled and supported for your tenant.

Solution 3

Contact Microsoft 365 Support

If prompts persist after modifying the registration campaign and verifying policies, reach out to support for advanced administrative assistance.

Free Microsoft Office alternative

Looking for a Hassle-Free Office Suite? Try WPS Office

While managing complex Microsoft 365 MFA settings can be challenging for IT admins, your users' daily document work doesn't have to be. WPS Office is a lightweight, highly compatible alternative to Microsoft Office that offers word processing, spreadsheets, and presentations without the heavy administrative overhead.

1. Visit the Website: Go to the official WPS Office website to find the correct version for your operating system.
2. Download the Installer: Click the 'Free Download' button to get the lightweight installation package.
3. Install and Work: Run the installer and instantly start editing your Office documents with no complex cloud logins required.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight design that installs quickly and runs smoothly on older hardware.Familiar user interface with zero learning curve for seamless team migration.Robust PDF editing tools integrated directly into the office suite.

microsoft office alternative - wps office

Frequently Asked Questions

Why is Microsoft forcing the Authenticator app by default?

Microsoft uses a 'Registration campaign' to nudge users toward the Microsoft Authenticator app because it provides a more secure, phishing-resistant form of Multi-Factor Authentication compared to easily intercepted SMS texts or voice calls.

Can I completely disable MFA for desk-phone users?

It is highly discouraged to completely disable MFA for any user. Instead, you should keep MFA enabled but configure your Entra ID policies to allow alternative, approved authentication methods like voice calls for those who cannot use mobile apps.

How long does it take for the Registration campaign changes to take effect?

Changes made in the Microsoft Entra admin center typically take effect within a few minutes, but it can sometimes take up to 24 hours for policy changes to fully replicate across all Microsoft 365 services and active sessions.

What if a user has already registered for the Authenticator app but needs to switch back?

If a user has already registered, an administrator can manually change their default sign-in method to 'Voice call' in the Entra ID user authentication methods pane, or the user can change their default preference at mysignins.microsoft.com.

Microsoft Office Security Issues