How to Disable Authenticator Requirement for Entra Users

Question

I have disabled the first time login password change requirement for a small group of Entra users. Now I need to disable the requirement to set up an Authenticator account; I do not need MFA for these users.

Answer 1

Hello @Harris, David,

Thank you for connecting offline over the team's call.

As discussed, we observed that your users were being prompted for MFA registration each time they signed in to an application due to Self-Service Password Reset (SSPR) being enabled in your tenant. When SSPR is enabled, users must register at least one authentication method to complete the SSPR registration process.

Since you wanted to prevent users from being prompted for MFA registration, we have disabled SSPR in your tenant. After making this change, users were no longer prompted to register for MFA when signing in.

For more details on SSPR and its impact, you can refer to the official Microsoft documentation:

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

Hello Harris, David,

Based on your query, I understand you would like to disable the authenticator for some users.

Here are some steps you need to follow and check:

1. First, you need to disable the Security default settings.https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults?WT.mc_id=Portal-Microsoft_AAD_IAM#disabling-security-defaults
2. Check if any conditional access policies have been enabled for the required users.https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups#exclude-users
3. Check the registration campaign settings. If enabled, you need to exclude those users from the registration campaign.How to run a registration campaign to set up Microsoft Authenticator - Microsoft Entra ID | Microsoft Learn
4. From the modern authentication settings, you have to exclude those users.Microsoft Authenticator authentication method - Microsoft Entra ID | Microsoft Learn

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment"

Answer 3

You can refer this article https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userdevicesettings

If you have Conditional Access policies in place that enforce MFA, you may need to modify or exclude these users from the policy.

• Navigate to Azure Active Directory > Security > Conditional Access.
• Review your policies and ensure that the users or group in question are excluded from any policies that enforce MFA. https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-mfa-strength