Security defaults enabled, users setup MFA, now 365 doesn't prompt for MFA on new devices

Question

Setup a client on 365 and setup 'security defaults' in mid december. When I did all users were prompted to setup MFA via the MS Authenticator. They did so and all was well.

Had a problem today with someone accessing one of the accounts, and found that security defaults is still configured, but NONE of the users are being prompted for MFA on new device logons.

Did something change with the new year or something?

I enabled MFA per user so we are protected again, but why did our security drop out from under us with no admin intervention???

Any thoughts are much appreciated!

---

Moved from Microsoft 365 and Office | Other

Answer 1

Dear @Mick,

Thank you for posting your question in the Microsoft Q&A forum.

Based on your description, security defaults were enabled and all users originally set up MFA, but now Microsoft 365 no longer prompts for MFA on new device sign‑ins. No admin changes were made. You wonder there are something change, and why did MFA stop enforcing under security defaults.Here are some information you can refer to:

Microsoft did not push any New‑Year change that disables MFA prompts. What you are seeing is normal Security Defaults behavior, not a system change.

Security Defaults do NOT guarantee an MFA prompt on every new device or every sign‑in. Microsoft states that users are prompted for MFA only “when necessary”, which is determined by Microsoft’s internal risk engine, not by device alone. Sometimes a new device sign‑in is still considered low‑risk, so no MFA challenge is shown.

This is why everything worked after initial setup in December, but MFA prompts became less frequent later.

It looks like security dropped, but this is actually a known limitation of Security Defaults:

• Security Defaults enforce MFA only when Microsoft decides it is required, not every login and not every device.
• It is risk‑based, not per‑device.
• Over time, cached tokens, trusted sessions, and low‑risk logins can bypass MFA.
• This matches other admins’ experiences: per‑user MFA gives consistent prompts, security Defaults does not.

So, your tenant didn’t weaken itself, Security Defaults simply doesn’t enforce MFA the way you expected.

When you switched to per‑user MFA, prompts immediately returned, confirming the issue was Security Defaults’ design, not a failure.

For more information Set up multifactor authentication for Microsoft 365

I hope information above meet your expectations, if you have any other questions or need more supporting, please feel free to reach out.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thanks, it was just strange it prompted on every device when we set it up, then NO devices, so I wanted to be certain. I enforced MFA for all users so one way or another we should be good.