How to disable "more information required"

Question

How to disable "more information required"

Dean Yan 25

I am struggling with the prompt for MFA (More information required). all solutions I found on the Internet do not work.

1, "Security Defaults" in Azure AD have been disabled.

2, "multi-factor authentication" settings in MS365 admin have been disabled.

3, No any Conditional Access policies.

4, "Self service password reset enabled" set "None"

I do not know why the prompt still exists. Please support.

Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T02:33:59.6733333+00:00

Is per-user MFA enabled? https://www.alitajran.com/configure-per-user-mfa/
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T02:36:32.7+00:00

Its also possible - the MFA requirement is also required by an Organisation you are tied to:

https://support.microsoft.com/en-us/account-billing/manage-organizations-for-a-work-or-school-account-in-the-my-account-portal-a9b65a70-fec5-4a1a-8e00-09f99ebdea17

I have seen this happen before, if you have organisations you are tied to and don't need then remove - if not then check with them as they may be enforcing that you have MFA enabled to access their resources.
Dean Yan 25 Reputation points

2023-07-05T02:40:48.9233333+00:00

No, it is disabled.
Dean Yan 25 Reputation points

2023-07-05T02:45:10.9933333+00:00

Hi,

thank you for your support.

per-user MFA is disabled.

and only home organization.
Dean Yan 25 Reputation points

2023-07-05T02:46:43.31+00:00

Hi,

thank you for your support.

per-user MFA is disabled.

and only home organization.
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T02:53:13.4166667+00:00
Does your account have an Azure admin role associated?

Administrator reset policy differences

This overrides the other SSPR policies.

You can disable the use of SSPR for administrator accounts using the Update-MgPolicyAuthorizationPolicy PowerShell cmdlet. The -AllowedToUseSspr:$true|$false parameter enables/disables SSPR for administrators. Policy changes to enable or disable SSPR for administrator accounts can take up to 60 minutes to take effect.
Dean Yan 25 Reputation points

2023-07-05T03:19:27.21+00:00

I received the email notification about your new comment.

"Does your account have an Azure admin role associated? Administrator reset policy differences This overrides the other SSPR policies. You can disable the use of SSPR for administrator accounts using the Update-MgPolicyAuthorizationPolicy PowerShell…"

But I did not find it on the website.

here is my answer:

I use the globe administrator account to sign in to check the configurations, but the account which got the prompt for MFA (More information required) is just a normal user account.
Dean Yan 25 Reputation points

2023-07-05T03:48:16.9+00:00

Hi,

the account which got the prompt for MFA (More information required) is just a normal account.
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T04:10:53.42+00:00

Thanks, Dean.

The only other thing I can think of at the moment is that the Authentication method is set, or there is a registration campaign to enable Microsoft Authenticator set:
Dean Yan 25 Reputation points

2023-07-05T04:31:05.5566667+00:00

Thanks, Luke, right?

Yes, our settings are exactly the same as your screenshot.

How can I disable or delete or modify it?
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T04:48:30.0066667+00:00

I don't have the license to see the settings in my AAD tenancy, but you should be able to edit the settings and expand out the excluded users and groups. If you click Edit, you may be able to change it to custom settings vs Microsoft set.
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T19:41:15.7233333+00:00

How did it go?
Dean Yan 25 Reputation points

2023-07-05T20:51:33.3466667+00:00

I do not know how long Azure AD need to wait to apply the change.

I changed the state to disable. and I checked this morning, and the issue still exists.

I will give try to choose an empty group, instead all users right now.
Dean Yan 25 Reputation points

2023-07-05T20:52:50.48+00:00
Dean Yan 25 Reputation points

2023-07-05T20:55:15.12+00:00

but as I understand, these settings should be under or controlled by the "security default".
Dean Yan 25 Reputation points

2023-07-05T22:21:00.0633333+00:00

Hi, Luke.

it still does not work even though I changed all settings on this page.
Dean Yan 25 Reputation points

2023-07-06T02:23:49.0333333+00:00

Any other ideas?

The existing users do not have this issue (More information required), this happened just for the new users I created.
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-06T02:32:20.2733333+00:00

I am personally running out of ideas, is Identity protection turned on for MFA registration?
Dean Yan 25 Reputation points

2023-07-06T02:38:11.94+00:00

we are using MS365 standard licenses, not premium, and can not configure these settings (grey out)
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-06T18:50:38.7466667+00:00

Ok, you may have to open a support case to go through the logs; my mind is a bit blank at the moment of what to try next. You should encourage MFA though., but there should still be a reason why its being triggered.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Dean Yan 25 Reputation points

2023-07-07T02:15:36.7366667+00:00

I found the reason.

Because the computer is newly installed and configured for a new user. Thus, this is related to the settings of the device.

go to device settings in AzureAD, and select "No" on the "Require Multi-Factor Authentication to register or join devices with Azure AD" setting.

Problem solved.

Thank you for your support. very appreciate.
Sandeep G-MSFT 20,906 Reputation points Microsoft Employee Moderator

2023-07-07T03:58:59.4566667+00:00

@Dean Yan

User getting prompted for MFA can only happen due to security defaults/per-user MFA/conditional access policy/identity protection.

Apart from this there is an option in authentication methods as Luke mentioned.

In the above screenshot you can try to exclude the problematic user and test if that helps.

If this not working let me know so that we can work on this offline.

Please send us an email on azcommunity [at] microsoft [dot] com with Sub - Attn: Sandeg and following details in the email body:

Link to this thread/post

We can connect offline and discuss further on this.
Dean Yan 25 Reputation points

2023-07-07T04:03:59.2633333+00:00

Hi, Sandeep:

All good, I think I solved the issue which just happened for the new devices configuring.

Thank you for all your help.
Bruce LARRE 21 Reputation points

2024-09-25T18:48:01.0966667+00:00

@Dean Yan thank tou sooo much for your feedback, I was stuck in the same situation and starded to get crazy (Already looked in MFA, defaults, campaigns, before looking for help, it was my last hope)

Have a good day !

Accepted answer

0 additional answers

Your answer

Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T02:33:59.6733333+00:00

Is per-user MFA enabled? https://www.alitajran.com/configure-per-user-mfa/
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T02:36:32.7+00:00

Its also possible - the MFA requirement is also required by an Organisation you are tied to:

https://support.microsoft.com/en-us/account-billing/manage-organizations-for-a-work-or-school-account-in-the-my-account-portal-a9b65a70-fec5-4a1a-8e00-09f99ebdea17

I have seen this happen before, if you have organisations you are tied to and don't need then remove - if not then check with them as they may be enforcing that you have MFA enabled to access their resources.
Dean Yan 25 Reputation points

2023-07-05T02:40:48.9233333+00:00

No, it is disabled.
Dean Yan 25 Reputation points

2023-07-05T02:45:10.9933333+00:00

Hi,

thank you for your support.

per-user MFA is disabled.

and only home organization.
Dean Yan 25 Reputation points

2023-07-05T02:46:43.31+00:00

Hi,

thank you for your support.

per-user MFA is disabled.

and only home organization.
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T02:53:13.4166667+00:00

Does your account have an Azure admin role associated?

Administrator reset policy differences

This overrides the other SSPR policies.

You can disable the use of SSPR for administrator accounts using the Update-MgPolicyAuthorizationPolicy PowerShell cmdlet. The -AllowedToUseSspr:$true|$false parameter enables/disables SSPR for administrators. Policy changes to enable or disable SSPR for administrator accounts can take up to 60 minutes to take effect.
Dean Yan 25 Reputation points

2023-07-05T03:19:27.21+00:00

I received the email notification about your new comment.

"Does your account have an Azure admin role associated? Administrator reset policy differences This overrides the other SSPR policies. You can disable the use of SSPR for administrator accounts using the Update-MgPolicyAuthorizationPolicy PowerShell…"

But I did not find it on the website.

here is my answer:

I use the globe administrator account to sign in to check the configurations, but the account which got the prompt for MFA (More information required) is just a normal user account.
Dean Yan 25 Reputation points

2023-07-05T03:48:16.9+00:00

Hi,

the account which got the prompt for MFA (More information required) is just a normal account.
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T04:10:53.42+00:00

Thanks, Dean.

The only other thing I can think of at the moment is that the Authentication method is set, or there is a registration campaign to enable Microsoft Authenticator set:
Dean Yan 25 Reputation points

2023-07-05T04:31:05.5566667+00:00

Thanks, Luke, right?

Yes, our settings are exactly the same as your screenshot.

How can I disable or delete or modify it?
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T04:48:30.0066667+00:00

I don't have the license to see the settings in my AAD tenancy, but you should be able to edit the settings and expand out the excluded users and groups. If you click Edit, you may be able to change it to custom settings vs Microsoft set.
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-05T19:41:15.7233333+00:00

How did it go?
Dean Yan 25 Reputation points

2023-07-05T20:51:33.3466667+00:00

I do not know how long Azure AD need to wait to apply the change.

I changed the state to disable. and I checked this morning, and the issue still exists.

I will give try to choose an empty group, instead all users right now.
Dean Yan 25 Reputation points

2023-07-05T20:55:15.12+00:00

but as I understand, these settings should be under or controlled by the "security default".
Dean Yan 25 Reputation points

2023-07-05T22:21:00.0633333+00:00

Hi, Luke.

it still does not work even though I changed all settings on this page.
Dean Yan 25 Reputation points

2023-07-06T02:23:49.0333333+00:00

Any other ideas?

The existing users do not have this issue (More information required), this happened just for the new users I created.
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-06T02:32:20.2733333+00:00

I am personally running out of ideas, is Identity protection turned on for MFA registration?
Dean Yan 25 Reputation points

2023-07-06T02:38:11.94+00:00

we are using MS365 standard licenses, not premium, and can not configure these settings (grey out)
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-07-06T18:50:38.7466667+00:00

Ok, you may have to open a support case to go through the logs; my mind is a bit blank at the moment of what to try next. You should encourage MFA though., but there should still be a reason why its being triggered.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Dean Yan 25 Reputation points

2023-07-07T02:15:36.7366667+00:00

I found the reason.

Because the computer is newly installed and configured for a new user. Thus, this is related to the settings of the device.

go to device settings in AzureAD, and select "No" on the "Require Multi-Factor Authentication to register or join devices with Azure AD" setting.

Problem solved.

Thank you for your support. very appreciate.
Sandeep G-MSFT 20,906 Reputation points Microsoft Employee Moderator

2023-07-07T03:58:59.4566667+00:00

@Dean Yan

User getting prompted for MFA can only happen due to security defaults/per-user MFA/conditional access policy/identity protection.

Apart from this there is an option in authentication methods as Luke mentioned.

In the above screenshot you can try to exclude the problematic user and test if that helps.

If this not working let me know so that we can work on this offline.

Please send us an email on azcommunity [at] microsoft [dot] com with Sub - Attn: Sandeg and following details in the email body:

Link to this thread/post

We can connect offline and discuss further on this.
Dean Yan 25 Reputation points

2023-07-07T04:03:59.2633333+00:00

Hi, Sandeep:

All good, I think I solved the issue which just happened for the new devices configuring.

Thank you for all your help.
Bruce LARRE 21 Reputation points

2024-09-25T18:48:01.0966667+00:00

@Dean Yan thank tou sooo much for your feedback, I was stuck in the same situation and starded to get crazy (Already looked in MFA, defaults, campaigns, before looking for help, it was my last hope)

Have a good day !

Answer 1

@Dean Yan

It is great that issue is resolved now.

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "[The question author cannot accept their own answer. They can only accept answers by others] (https://docs.microsoft.com/en-us/answers/support/accepted-answers#why-only-one-accepted-answer)**)", I'll repost your solution in case you'd like to "[Accept] (https://docs.microsoft.com/en-us/answers/support/accepted-answers#accepted-answer-in-a-question-thread)**)" the answer.

This issue was due to the configuration for new device.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Share via

How to disable "more information required"

0 additional answers

Your answer