Turn off Multi Authentication for user that doesn't have a smart phone

Question

I have a couple of elder users that are accessing office.com and outlook.com - it is requiring them to Enter/use the Microsoft Authentication application - which is real hard to do with a Flip phone (non-smart phone). Everything that I have tried doesn't work. Any help would be most appreciated. There is some setting in the Admin portal that should allow it to not require it for 1 or two users. Currently in the multi-factor for the user it shows disabled - but it still requires it.

Answer 1

Hello IT Support,

Thanks for your question.

Unfortunately, it is not possible to turn off MFA for specific user(s) when Security Defaults is enabled. If this is the case you may need to consider disabling it for your tenant. to do this, see: https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults#disabling-security-defaults

If your multifactor Authentication is enabled via Conditional access, you can choose to exclude them from the specific policies that trigger MFA for that user. Your changes are probably being registered but being overidden by the policies.

To exclude users, navigate to the conditional Access policy and:

1. Under Assignments select Users and groups.
2. On the Include tab, select All Users.
3. Under Exclude, select Users and groups and choose the exclusion group you created.

See: https://learn.microsoft.com/en-us/entra/id-governance/conditional-access-exclusion#create-a-conditional-access-policy-that-excludes-the-group

Please let me know if you have further questions**

You can mark it 'Accept Answer' if this helped.