Why Users Get MFA Prompts When Multifactor Authentication Is Disabled in Office 365
Question details
Users are being unexpectedly prompted for multifactor authentication (MFA) despite MFA and security defaults being globally disabled.
- Product
- Microsoft Office 365 / Entra ID
- Device & OS
- not provided
- Scenario
- Signing into Microsoft services while working onsite on the internal company network.
- Observed behavior
- Users are redirected to the Microsoft App Access Panel and prompted for MFA only when working onsite, despite global MFA being disabled.
Ensure you have access to your organization's Microsoft Entra sign-in logs, or coordinate with your identity and network administrators before proceeding.
Test Network Environment and Browser Context
Isolate the issue by testing the sign-in process from outside the internal network and using a private browsing session.
Network appliances or specific network configurations can inadvertently trigger location-based policies or alter identity provider rules, resulting in an MFA prompt.
Launch your web browser and open a new InPrivate (Edge) or Incognito (Chrome) window. Navigate to https://office.com and attempt to sign in.
If a firewall, VPN, or proxy is actively enabled on your onsite device, temporarily disable it if permitted by your IT policy, and test the sign-in again.
Because the issue appears to occur only on the internal company network, connect a test device to an external network (such as a mobile hotspot) to determine whether the onsite network environment is responsible for the prompts.
Review Entra ID Sign-in Logs and Conditional Access Policies
Check Microsoft Entra identity provider logs to determine exactly which policy or rule is enforcing the MFA prompt.
Switch to WPS Office for a Hassle-Free Productivity Experience
While complex IT policies, Conditional Access rules, and unexpected MFA prompts can disrupt access to Microsoft Office services, WPS Office offers a free, lightweight, and highly compatible alternative. Enjoy seamless document creation without being locked out by complex cloud authentication schemes.
- 1. Download the software: Visit the official WPS website and download the free WPS Office suite for your operating system.
- 2. Install WPS Office: Run the downloaded installer and follow the simple on-screen instructions to set up the software on your device.
- 3. Open existing documents: Launch WPS Office and directly open your existing .docx, .xlsx, or .pptx files to continue working seamlessly without login interruptions.
Frequently Asked Questions
Can an internal firewall or proxy trigger unexpected MFA prompts?
Yes. Certain network appliances like proxies or firewalls might manipulate network traffic or present external IP addresses that trigger location-based Conditional Access policies in Microsoft Entra, resulting in unexpected MFA prompts.
Why does the sign-in log show a redirection to the App Access Panel?
Redirection to the App Access Panel usually indicates that an enterprise identity rule or a third-party Identity Provider (IdP) integration is intercepting the sign-in request to evaluate strict security conditions before granting access.
How do I find out which Conditional Access policy is enforcing MFA?
Administrators can review the Microsoft Entra sign-in logs. By selecting a specific sign-in event and navigating to the 'Conditional Access' tab, you can view exactly which policies were evaluated and applied during that user's session.
Does disabling 'Security Defaults' completely turn off MFA across the organization?
Not necessarily. Even if global security defaults and per-user MFA are disabled, multifactor authentication can still be strictly enforced through individual Conditional Access policies, third-party identity providers, or specific application access rules.
