how to turn off MFA for a specific user

Trevor Bennett 20 Reputation points
2026-03-25T08:13:16.68+00:00

I would like to turn off any form of MFA for a specific user in my tenant

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
0 comments No comments

Answer accepted by question author

Shubham Sharma 17,915 Reputation points Microsoft External Staff Moderator
2026-03-25T08:30:43.1533333+00:00

Hello Trevor Bennett

Thank you for reaching out to Microsoft Q&A.

1. Disable Per‑User MFA (legacy MFA)

This is the most common place MFA is enabled per account.

Steps

  • Sign in to the Microsoft Entra admin center
  • https://entra.microsoft.com
  • Go to Identity → Users → All users
  • Select Per-user MFA (top menu)
  • Find the target user
  • Select the user → Disable → Save

Microsoft Docs

Change the MFA status for a user (Per-user MFA)

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates

2. Ensure Security Defaults are disabled (tenant-wide)

If Security Defaults are enabled, MFA cannot be disabled per user.

Steps

Entra admin center → Identity → Overview

Select Properties

Click Manage security defaults

Set Security defaults to Disabled

Save

Microsoft Docs

Security defaults in Microsoft Entra ID

https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

3. Exclude the user from Conditional Access policies

If Conditional Access enforces MFA, per-user MFA settings are ignored.

Steps

  • Entra admin center → Protection → Conditional Access
  • Open each policy that requires Require multifactor authentication
  • Under Assignments → Users
  • Exclude the specific user (or an exclusion group)
  • Save the policy

Microsoft Docs

Conditional Access: Exclude users from policies

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policies

4. Confirm no Identity Protection policy requires MFA

Risk-based policies can still trigger MFA.

Check

Entra admin center → Protection → Identity Protection

Review Sign-in risk and User risk policies

Ensure the user is excluded (if applicable)

After completing the above steps:

  • Sign in as the user in a new browser session
  • The user should not be prompted for MFA registration or challenge

Important: MFA can be enforced in multiple places. To fully disable MFA for one user, you must verify all applicable layers.

Please let us know the above steps helps!

Thanks

If the resolution was helpful, please accept the answer and upvote it 👍 to make it helpful for the community.

Was this answer helpful?

0 comments No comments

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.