Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Entra MFA - Multiple Issues
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(73.60000000000001, 21%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
at_work
0
Reputation points
- SMS must be enabled as an authentication method for new user initial login and authenticator setup.
- If SMS is disabled, the user gets a prompt to contact admin, and that they are blocked from signing in (this is despite there being multiple other auth methods enabled)
- This was after using TAP for initial sign-in (I want to sunset passwords)
- Accounts excluded from MFA CA are still prompted or required to set up MFA, even disabled legacy authentication methods.
- Fido2 keys not available as an MFA method despite being explicitly enabled in auth method policies.
- I had to use a TAP in order to set up a YubiKey usb fido2 key with my Break Glass Account.
- My tenant is a legacy tenant -- is this the reason why my Entra auth policies don't work?
- How do I make my tenant passwordless for all users? Or all users who are not Service Accounts, Break Glass Accounts, and Administrators?
Microsoft Security | Microsoft Entra | Microsoft Entra ID
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 99%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Rukmini 43,260 Reputation points Microsoft External Staff Moderator2026-04-30T02:07:52.52+00:00 Hello at_work
This behavior is expected and due to policy configuration, not because your tenant is legacy.
- SMS required/user blocked: Occurs when no other method has been registered. Before turning off SMS, make sure TAP, Authenticator, or FIDO2 is accessible.
- MFA prompted despite CA exclusion: Probably because of Registration Campaign or Security Defaults.
- Turn off Security Defaults and bar users from both CA and registration rules
- FIDO2 not visible: Verify that the user is inside the parameters of the FIDO2 policy, is using a compatible browser, and has enabled combined registration.
TAP required prior to FIDO2: TAP is necessary for the first passwordless bootstrap by design.
Setting up without a password is advised.
- Turn Off Security Defaults
- In Authentication Methods, enable FIDO2, Authenticator, and TAP.
- Enforce the FIDO2/Auth app after using TAP for onboarding
- To mandate phishing-resistant MFA, use Conditional Access
- Exclude break-glass, service, admin accounts via groups
Let me know if any further queries - feel free to reach out!
-
at_work 0 Reputation points
2026-05-01T16:48:43.0533333+00:00 - SMS was disabled, but Fido2, Msft Authenticator, and TAP are all enabled. TAP is used for first sign-on. Ideally, I'm directing new users to use only Microsoft Authenticator Passwordless, and Fido2 primarily for Break Glass accounts and users who can't use a mobile app for MFA. Still, SMS being disabled prevented users from logging in and initiating any authenticator setup.
- No registration campaign and security defaults disabled.
- Working with break glass accounts, I had to set up Fido2 via mysignins.microsoft.com. Legacy hardware tokens still visible during setup despite being explicitly disabled in Auth methods.
- Excluding glass-break accounts from CA/MFA still forces the "Let's secure your account" prompt and causes a looping behavior until I provide TAP. Once I provide TAP I am able to get to mysignins to set up Fido2. Still, getting the "Let's secure your account" prompt every single login with break glass accounts and have to skip every time I access a new portal (e.g. entra, azure, etc.).
Unfortunately, nothing is resolved. Legacy MFA is disabled, Security Defaults are disabled automatically due to CA policies being in place (that's how it appears), and Authenticator registration campaign is disabled.
My account initiation process is still TAP-based, but if SMS is disabled as an Auth method, users cannot set up Authenticator or Fido2, they are simply locked out of any steps and are instructed to contact Admin as login is blocked.
There is something preventing expected behavior here, I have a ticket in with Microsoft, but I have not heard back yet. If there is no Legacy Tenant hidden settings blocking me, I am at a loss as to why this behavior is still happening.
Sign in to comment
Sign in to answer