Managing external identities to enable secure access for partners, customers, and other non-employees
Hello Trevor Bennett
Thank you for reaching out to Microsoft Q&A.
1. Disable Per‑User MFA (legacy MFA)
This is the most common place MFA is enabled per account.
Steps
- Sign in to the Microsoft Entra admin center
- https://entra.microsoft.com
- Go to Identity → Users → All users
- Select Per-user MFA (top menu)
- Find the target user
- Select the user → Disable → Save
Microsoft Docs
Change the MFA status for a user (Per-user MFA)
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates
2. Ensure Security Defaults are disabled (tenant-wide)
If Security Defaults are enabled, MFA cannot be disabled per user.
Steps
Entra admin center → Identity → Overview
Select Properties
Click Manage security defaults
Set Security defaults to Disabled
Save
Microsoft Docs
Security defaults in Microsoft Entra ID
https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
3. Exclude the user from Conditional Access policies
If Conditional Access enforces MFA, per-user MFA settings are ignored.
Steps
- Entra admin center → Protection → Conditional Access
- Open each policy that requires Require multifactor authentication
- Under Assignments → Users
- Exclude the specific user (or an exclusion group)
- Save the policy
Microsoft Docs
Conditional Access: Exclude users from policies
4. Confirm no Identity Protection policy requires MFA
Risk-based policies can still trigger MFA.
Check
Entra admin center → Protection → Identity Protection
Review Sign-in risk and User risk policies
Ensure the user is excluded (if applicable)
After completing the above steps:
- Sign in as the user in a new browser session
- The user should not be prompted for MFA registration or challenge
Important: MFA can be enforced in multiple places. To fully disable MFA for one user, you must verify all applicable layers.
Please let us know the above steps helps!
Thanks
If the resolution was helpful, please accept the answer and upvote it 👍 to make it helpful for the community.