Users forced to set up Microsoft Authenticator despite Registration Campaign being disabled.

Question

I'm an IT administrator for a small business, who's users are now getting the dreaded prompt to set up Microsoft Authenticator upon signing in.

We've been delaying this as much as possible as it's not a feature we're interested in. Following the advice from this thread:

https://learn.microsoft.com/en-us/answers/questions/1338546/users-are-being-forced-to-use-microsoft-authentica?page=2&orderby=Helpful#answers

I was able to go to the Entra center and disable the registration campaign for all our users:

As well as switch system-preferred MFA to "disabled" in Azure AD

It has changed nothing. Users are still forced to set up authentication with no option to opt out. How do I get rid of this. Is there something that needs to be done on the workstation side to sync these settings?

Answer 1

I have users who have language challenges. I have users who have physical disabilities. These requirements are a burden. We need to disable them. The loss of security is OK in these specific cases. Let us make decisions for ourselves!!!!

Answer 2

I just discovered that if you enable users to reset their own password, that setting comes with it's own registration setting. You have ADDITIONALLY turn off Registration in the Password Reset management interface. I had boneheadedly skipped the registration section thinking I had already disabled it elsewhere..... which introduces the idea that maybe it's not so great to have controls for the same setting in multiple locations. Microsoft should be sure to give settings DISTINCT names in the control descriptions so this sort of confusion is less likely to happen.