One user use single factor authenticator sign in but rest users use MFA. We want all users use MFA to sign in.

Question

One user use single factor authenticator sign in but rest users use MFA. We want all users use MFA to sign in.

Jack Yuan 0

We did not set up any condition access policy. The user registered a MFA device as well, but he dont need to sign in use the authenticator.

1 answer

Your answer

Answer 1

VEMULA SRISAI 9,745 Microsoft External Staff Moderator

From what you described, the behavior you’re seeing is expected.

Registering an MFA method (for example, Microsoft Authenticator) does not automatically enforce MFA at sign-in. Authentication methods only make MFA available to the user; something must explicitly require it. Since you don’t have Security Defaults, Conditional Access, or per‑user MFA (legacy) enforcing MFA, that user can still sign in using single-factor authentication even though an MFA device is registered

Other users in your tenant are likely being prompted because they are covered by a policy (for example, Security Defaults, legacy per-user MFA, or an existing Conditional Access policy), while this specific user is not.

How to enforce MFA for all users

You have two supported options:

Option 1: Enable Security Defaults (recommended if you don’t use Conditional Access)

Security Defaults automatically require MFA for all users and admins and block legacy authentication. This is suitable if you don’t have complex access requirements or Entra ID P1/P2 licenses

https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

Option 2: Create a Conditional Access policy (recommended for P1/P2 tenants)

If you have Microsoft Entra ID P1 or P2, the recommended approach is to create a Conditional Access policy that:

Targets All users (exclude emergency/break-glass accounts)
Targets All cloud apps
Grants access Require multifactor authentication (or an MFA authentication strength)

This ensures every sign-in requires MFA, regardless of whether the user has already registered an MFA method.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-mfa-strength

Important note

Legacy per-user MFA is no longer recommended and is being retired. Microsoft’s guidance is to use Conditional Access or Security Defaults for consistent and future-proof MFA enforcement.

Jack Yuan 0 Reputation points

2026-03-04T01:24:18.2433333+00:00

Hi Vemula,

Thanks for your quick response. I just checked and can confirm that we have enabled the security default a long time ago. Please see the screenshot below.

But now the user needs to use MFA to sign in after I enable the Per-user MFA in the M365 admin centre. Does it make sense. I thought the default security could override the per-user MFA settings.

Regards

Jack
VEMULA SRISAI 9,745 Reputation points Microsoft External Staff Moderator

2026-03-05T11:41:53.6833333+00:00

Jack Yuan Yes, this behavior is expected. Security Defaults do not enforce MFA on every sign‑in; they require MFA only when Microsoft determines it’s necessary (based on risk, role, activity, etc.). Because of that, a user can still complete a single‑factor sign‑in in low‑risk scenarios even when Security Defaults are enabled.

When you enabled per‑user MFA, MFA was enforced unconditionally, which is why the user was then prompted every time. Security Defaults do not override per‑user MFA—they operate independently.

For a supported and future‑proof approach, Microsoft recommends enforcing MFA for all users using a Conditional Access policy (and avoiding legacy per‑user MFA).
VEMULA SRISAI 9,745 Reputation points Microsoft External Staff Moderator

2026-03-06T11:55:11.5933333+00:00

Jack Yuan Just following up to check whether the explanation around Security Defaults and per‑user MFA clarifies the behavior you’re seeing. As noted, Security Defaults apply risk‑based MFA and may not prompt on every sign‑in. Per‑user MFA enforces MFA unconditionally, which is why the prompt appeared after enabling it. Please let me know if you’d like guidance on enforcing MFA consistently using Conditional Access
Raja Pothuraju 45,955 Reputation points Microsoft External Staff Moderator

2026-03-12T13:23:23.4433333+00:00

@Jack Yuan, Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Share via

One user use single factor authenticator sign in but rest users use MFA. We want all users use MFA to sign in.

1 answer

Your answer