MFA Excluded accounts - still prompting for MFA registration

Question

Hi Team,

We have enabled the MFA in our organisation and we have created conditional access policy for the service accounts to exclude from MFA. We have disabled the MFA for those accounts under O365 admin > Active users> MFA when we try login to those accounts it still take us to the MFA Registration page and users have to click on skip setup each time when i try login. Is there any options available which bypass the MFA registration page? Please advise.

Thanks,

Ranjit

Answer 1

Glad to see that you managed to get this resolved.

Remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

MFA registration can be assigned via different means - you'd want to check all possible options

https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates

---

hth

Marcin

Answer 3

@Ranjit Singh,Thanks for posting in Q&A.

From your description, I know you want to disable MFA for some accounts.

I have done research about this problem, here are some information you can refer.

1.If you have enabled MFA in your organization and want to create Conditional Access policy to exclude some accounts from MFA, in the Users session, you can select the user group for Exclude and in Target resources session, select All cloud apps, then in Grant session, select Require multifactor authentication.

2.You can disable MFA for specific users in the Microsoft 365 admin center.

https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide#turn-off-per-user-mfa

3.You can revoke multifactor authentication session in Microsoft Entra ID portal.

Hope it will help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

I figured out the issue was SSPR setting was assigned to all users, there is no option to exclude users, either assign it to a group or All users. So I ended up creating a Dynamic group for users need to be setup for SSPR which resolved the issue.

Answer 5

I figured out the issue was SSPR setting was assigned to all users, there is no option to exclude users, either assign it to a group or All users. So I ended up creating a Dynamic group for users need to be setup for SSPR which resolved the issue.