Remove MFA authentication including MS Authentiatoin and Phone/SMS for Azure User

Question

We have an azure user for which we want to remove Multifactor authentication. when i check in the Microsoft 365 admin center (admin.microsoft.com) for that user, i see that MFA is disabled, but when i try to login to https://outlook.office.com or portal.azure.com via the User login, it will ask me to register my mobile number or register using Microsoft autheticator app.

Basically for this user, i want to skip MFA. Please help

Answer 1

@MyAzQuery

Thank you for posting this in Microsoft Q&A.

You might be getting MFA registration prompt due to Entra registration campaign.

With this feature you can nudge users to set up Microsoft Authenticator during sign-in. Users go through their regular sign-in, perform multifactor authentication as usual, and then get prompted to set up Microsoft Authenticator. You can include or exclude users or groups to control who gets nudged to set up the app. This allows targeted campaigns to move users from less secure authentication methods to Authenticator.

You can also define how many days a user can postpone, or "snooze," the nudge. If a user taps Skip for now to postpone the app setup, they get nudged again on the next MFA attempt after the snooze duration has elapsed. You can decide whether the user can snooze indefinitely or up to three times (after which registration is required).

You can check below article and disable registration campaign in Microsoft Entra portal.

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-registration-campaign

Hope this helps in resolving the issue.

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Could be:

1. Conditional Access Policy: Exclude that user: https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-all-users-mfa#create-a-conditional-access-policy
2. MFA registration required for all: https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy#policy-configuration
3. Security Defaults enabled. If so, you cant exclude one user: https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults