Why user is being prompted to setup MFA when it is not even enabled?

Question

As you can see MFA is disabled:

However, user was keep getting below prompts while accessing office.com or portal.office.com. What is causing this and how to disable it?

Answer 1

Hello,

#1 Check if you have Security Defaults enabled in your tenant:

Security defaults in Azure AD

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

#2 I would also recommend checking for a Conditional Access Policy that enforces users to register with MFA:

Common Conditional Access policy: Require MFA for all users

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa

---

If this is helpful please accept answer.

Answer 2

The prompt you're seeing is not necessarily related to MFA. Check out this forum post of an extensive list of features that might cause this:

https://learn.microsoft.com/en-us/answers/questions/645850/what-are-the-services-settings-that-can-cause-mfa

Answer 3

@newhdanalyst

Users are prompted to register for MFA due to security defaults feature in Azure AD.

Microsoft is making security defaults available to everyone, because managing security can be difficult. Identity-related attacks like password spray, replay, and phishing are common in today's environment. More than 99.9% of these identity-related attacks are stopped by using multifactor authentication (MFA) and blocking legacy authentication. The goal is to ensure that all organizations have at least a basic level of security enabled at no extra cost.

Security defaults make it easier to help protect your organization from these identity-related attacks with preconfigured security settings:

• Requiring all users to register for Azure AD Multi-Factor Authentication.
• Requiring administrators to do multifactor authentication.
• Requiring users to do multifactor authentication when necessary.
• Blocking legacy authentication protocols.
• Protecting privileged activities like access to the Azure portal.

One of the preconfigured setting in security defaults is "All users must register for MFA"

Users have 14 days to register for Azure AD Multi-Factor Authentication by using the Microsoft Authenticator app or any app supporting OATH TOTP. After the 14 days have passed, the user can't sign in until registration is completed. A user's 14-day period begins after their first successful interactive sign-in after enabling security defaults.

If you do not want this feature to be enabled in your tenant then you can disable it by following below steps,

• Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.
• Browse to Azure Active Directory > Properties.
• Select Manage security defaults.
• Set the Enable security defaults toggle to No.
• Select Save

You can also refer below article for more information,

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

Do let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.