MFA Security Issues

How to Stop Microsoft Authenticator Prompts When MFA Is Disabled

Nimra Malik Oct 10, 2026 868 views

Question details

Users want to bypass the Microsoft Authenticator setup screen that appears during sign-in, even though multi-factor authentication (MFA) is turned off in the admin center.

How to Stop Microsoft Authenticator Prompts When MFA Is Disabled

Product: Microsoft 365 / Entra ID
Device & OS: not provided
Scenario: Signing into Microsoft 365 with newly created user accounts.
Observed behavior: Users are continuously prompted to set up the Microsoft Authenticator app, and no SMS authentication alternative is presented, despite MFA being disabled for the tenant.

Before you start

Ensure you have Global Administrator or Security Administrator privileges in the Microsoft Entra admin center before attempting to modify tenant-wide authentication settings.

Solution 1Recommended

Check and Disable Entra Security Defaults

Security Defaults automatically enforce MFA for all users, overriding individual or conditional access settings. Disabling this global setting is often the primary fix.

Microsoft enables Security Defaults on all new tenants by default to protect accounts. This setting mandates the use of the Microsoft Authenticator app and will ignore per-user MFA statuses.

Access the Entra Admin Center

Navigate to Properties

From the left-hand menu, expand 'Identity', click on 'Overview', and then select 'Properties'.

Manage Security Defaults

Scroll to the bottom of the Properties page and click on the 'Manage security defaults' link.

Disable the Setting

In the side panel, toggle the setting from 'Enabled' to 'Disabled (not recommended)'. Select a reason for disabling from the dropdown menu, and click 'Save'.

Check and Disable Entra Security Defaults

Security Consideration: Disabling Security Defaults removes baseline protections. It is highly recommended to configure custom Conditional Access policies to secure your environment if you choose to bypass these defaults.

Solution 2

Disable Authenticator Registration Campaigns

Microsoft occasionally runs automated registration campaigns that nudge users to set up Authenticator. You can disable this feature in your Authentication methods policy.

Solution 3

Revoke MFA Sessions for Affected Users

If a user was previously prompted or had MFA enabled, clearing their current authentication session forces the system to recognize the newly updated MFA status.

Free Microsoft Office alternative

Looking for a Hassle-Free Office Suite? Try WPS Office

If managing Microsoft 365's complex administrative centers, security defaults, and forced login methods is slowing down your workflow, consider WPS Office. It provides a straightforward, lightweight, and powerful alternative for your team's document creation needs without the overhead of mandatory tenant configurations.

1. Download the Installer: Visit the official WPS Office website and click the Free Download button.
2. Install WPS Office: Run the lightweight installer on your Windows, Mac, or Linux device.
3. Open Your Documents: Open your existing Microsoft Office documents directly in WPS Office with zero formatting loss and no complex login hurdles.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight installation with a familiar, easy-to-use tabbed interface.No complex tenant administration or forced MFA setups required to start editing files locally.Free core features to handle daily productivity tasks effortlessly.

microsoft office alternative - wps office

Frequently Asked Questions

Why does Microsoft prompt for Authenticator even when I disable per-user MFA?

Microsoft enables 'Security Defaults' for all new tenants to enforce baseline security. This global tenant setting overrides legacy per-user MFA configurations, forcing all users to register for the Microsoft Authenticator app within 14 days of their first sign-in.

How can I allow users to authenticate via SMS text instead?

You must configure the 'Authentication methods' policy in Microsoft Entra ID. Ensure the 'SMS' method is enabled and targeted to the appropriate users. Note that 'Security Defaults' heavily prioritize the Authenticator app, so you may need to disable defaults and use Conditional Access to offer SMS.

Will removing app passwords stop the Authenticator prompt?

Removing obsolete app passwords helps force modern authentication and clears out legacy security conflicts, but it does not stop the registration prompt by itself. You still need to address the registration campaign or Security Defaults that are triggering the setup requirement.

Microsoft Office Security Issues