The MFA page shows all my users with MFA `disabled` under `MULTI-FACTOR AUTH STATUS`. However, everyone still needs 2FA with an authenticator app. What gives?

Hello jon021,

Thank you for posting in the Microsoft community. We are happy to assist.

Based on the information you have shared with us; I understand you have a concern regarding disabling the MFA for all users.

In Microsoft 365 the MFA can be enable using 3 methods, Per-user MFA, Conditional Access policies and security defaults. To be able to disable the MFA you can verify if the users are not included in any policy that could enable MFA.

1. Check Conditional Access Policies:
   • Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
   • Browse to Protection > Conditional Access > Policies.
   • Review all policies to check if there is no policy that require to use multifactor authentication in the Grant section. you can turn off the policy or uncheck the check box of require muti-factor authentication
   • 
2. Verify Security Defaults:
   • Sign in to the Microsoft Entra admin center as least a Security Administrator.
   • Browse to Identity > Overview > Properties.
   • Select Manage security defaults.
   • Set Security defaults to Enabled.
   • Select Save.
3. Verify if per-user MFA is Turn off :
   • Double-check individual user settings to ensure there are no overrides or specific configurations enforcing MFA.
   • In the Microsoft 365 admin center, in the left nav choose Users > Active users.
   • On the Active users page, choose multifactor authentication.
   • On the multifactor authentication page, select each user and set their multifactor authentication status to Disabled.

You can try the above steps and let us know how it goes, if you have further concerns, please feel free to reply here, we will work together to find a direction specific to the situation.

Thank you for understanding and cooperation. I will be looking forward to your next updates.