How to disable MFA for all non-admin users

Question

I manage an org that has many shared user accounts due to our many volunteers. For example, our Facilities team volunteers all login to M365 using the same ******@mydomain.com user. I do not want these users to be required to use multifactor authentication, or to even be able to turn it on. How can I selectively disable MFA for these user accounts that our many volunteers utilize? I don't mind if the rest of the org (our paid staff) have to use MFA, but these few volunteer accounts need to remain only protected by a password that I randomize every few months. Thanks,

Answer 1

Hello Jamison,

Keep in mind that disabling MFA for a user account can reduce the security posture of your organization. Do you currently have a Conditional Access policy for the entire org that enables MFA? If not, you can do the following

1. Create a security group for exclusion. You can call it "MFA Excluded users" for example.
2. Configure Conditional Access Policy:
   1. Navigate to the Azure Active Directory admin center.
   2. Go to Security > Conditional Access.
   3. Select New policy.
   4. Name your policy (e.g., "Disable MFA for Volunteers").
   5. Under Assignments, select Users and Groups. Then, under Include, select All users. Under Exclude, choose the group "MFA Excluded Users" you created for shared accounts.
   6. Under Cloud apps or actions, you can select All Cloud apps or specify only Microsoft 365 apps as required.
   7. In the Conditions section, you can leave the default settings or adjust them as needed for your organization.
   8. Under Grant, select Grant access and ensure that Require multi-factor authentication is unchecked.
   9. Enable the policy by setting Enable policy to On.
   10. Click Create to apply the policy.

Notes: Make sure you have a break-glass account when enabling MFA. Also, you should look into Guest accounts as an alternative to this issue.

Let me know if that helps.

Answer 2

Hi @Jamison Hill

Thank you for posting your query on Q&A.

To answer your questions from Wilkin Sanchez answer, Entra is the new name for Azure Active Directory, so the admin center should be the same and very similar. You can access it by going to Entra admin center and signing in with your admin account.

The error message you are getting is because you need to specify at least one grant control or session control for your policy.

Grant controls are the actions that users must take to access the resource, such as MFA, device compliance. Session controls are the restrictions that apply to the user session after they are granted access, such as sign-in frequency, app enforced restrictions.

However, you can use the “Block access” option to deny access to the users or groups that you want to exclude from MFA. However, this will also prevent them from accessing any other resources that are protected by the policy, not just MFA.

The other side, since you are already using the Conditional Access policy MFA for all the users, I would suggest to exclude the MFA Users rather than include them. In this way you can apply the policy to all users by default, and only make exceptions for the ones that you want to exempt from MFA.

By using this approach, you can achieve more security and scalable, you don’t have to create separate policies for each group of users that you want to enforce MFA on.

I hope this information helps! please Feel free to ask any questions you may have.

Reference: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policies

https://learn.microsoft.com/en-us/entra/identity/conditional-access/plan-conditional-access

Thanks,

Akhilesh.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.