A user is excluded in conditional access policy but it is still applied

Question

Hi all,

I have a conditional access policy that requires MFA.

Last week a user called and reported that instead of logging into offie 365 account they get

"More information required
Your organization needs more information to keep your account secure"

This user is meant to be excluded from MFA.
I excluded that user in conditional access policy last Friday morning.

Today that user reported that they still unable to log in.
I checked MFA status in the Office 365 portal - Disabled

My questions are:

1. why conditional access policy is still applied after 72 hours has passed since I excluded them in conditional access policy?
2. is there any way to force the changes I did on Friday?

Answer 1

Hi @Lt. Columbo • Thank you for sharing required details.

I tracked the request in our backend and found that the conditional access policy "MFA Enforcement" is NOT getting applied to the user due to the exclusion of the user from the policy.

The reason why user is being prompted to registered for MFA by presenting More information required page, is due to the MFA Registration policy configured in Azure AD Identity Protection. If MFA is not needed for the user, the user account needs to be excluded from this policy, as mentioned below:

1. Navigate to the Azure portal.
2. Browse to Azure Active Directory > Security > Identity Protection > MFA registration policy.
3. Under Assignments
4. Users - All users are included and a specific set of users is excluded. However, the user, in this specific request, is NOT excluded.
5. You may choose to exclude the user from this policy, if MFA shouldn't be required for this user.
6. Enforce Policy - On
7. Save

Read more: How To: Configure the Azure AD Multi-Factor Authentication registration policy

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.