MFA Security Issues

Why Microsoft Entra MFA Status Shows Disabled with Security Defaults

Elise Williams Oct 12, 2026 868 views

Question details

Users notice their Microsoft Entra per-user MFA status is listed as 'Disabled' despite Security Defaults being active.

Why Microsoft Entra MFA Status Shows Disabled with Security Defaults

Product: Microsoft Entra
Device & OS: not provided
Scenario: Checking multi-factor authentication (MFA) status for users in the Microsoft 365 or Entra admin center.
Observed behavior: The per-user MFA status displays as 'Disabled', raising concerns that MFA protection is inactive.

Before you start

Verify whether your organization is using Security Defaults or Conditional Access policies, as this dictates how MFA is enforced across your tenant.

Solution 1Recommended

Rely on Tenant-Level Security Defaults

Understand that Security Defaults override the per-user MFA settings, making the 'Disabled' status expected and perfectly secure.

When Security Defaults are enabled in Microsoft Entra, multi-factor authentication is applied at the tenant level rather than on a per-user basis. Consequently, the traditional per-user MFA status column may still display 'Disabled' for users protected under these defaults. This is normal behavior and does not indicate a lack of protection.

Verify Security Defaults

Sign in to the Microsoft Entra admin center as a Security Administrator, navigate to Identity > Properties, and select 'Manage security defaults' to ensure the toggle is set to 'Enabled'.

Test User Login

Ask a user to sign in to their Microsoft 365 account from a new device or an incognito browser window. They should still be prompted to register for or use the Microsoft Authenticator app.

Ignore Per-User Status

Do not attempt to manually switch the per-user MFA status to 'Enabled' or 'Enforced' if you are relying on Security Defaults, as tenant-wide policies already cover these accounts.

Expected Behavior: Even with 'Disabled' showing in the per-user portal, users are fully protected by tenant-wide MFA.

Free Microsoft Office alternative

Looking for a Lightweight and Secure Office Suite?

While you manage your organization's IT security, ensure your users have access to a reliable, cost-effective office suite. WPS Office provides excellent compatibility with Microsoft Office formats without the heavy subscription fees.

1. Download WPS Office: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install and Sign In: Run the installer and sign in with your preferred account to unlock core editing features.
3. Open Existing Documents: Simply double-click any .docx, .xlsx, or .pptx file to open and edit it directly in WPS Office.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight application that runs smoothly on Windows, Mac, and Linux.Familiar user interface requiring zero learning curve for seamless migration.Built-in PDF editing tools for secure document management.

microsoft office alternative - wps office

Frequently Asked Questions

Do I need to enable per-user MFA if Security Defaults are on?

No. If Security Defaults are enabled, tenant-level MFA is automatically enforced for all users. You do not need to manage per-user MFA settings.

Why do some users show as 'Enabled' or 'Enforced' while others are 'Disabled'?

Users who previously had per-user MFA configured before Security Defaults were enabled will retain their 'Enabled' or 'Enforced' status. Newer users covered solely by Security Defaults will display 'Disabled'.

Can I use Conditional Access instead of Security Defaults?

Yes, organizations with Entra ID Premium licenses can use Conditional Access policies for more granular control. However, you must disable Security Defaults before enabling Conditional Access.

Microsoft Office Security Issues