Guest tenant users not able to register MFA

Question

I am using Entra Free Tier.
I have 3 issues that seem to be related but Ido not know how to resolve them. How can I resolve the below?

1. Our newly created tenant does not use legacy MFA but I see an alert to migrate off legacy MFA
2. I do not see a Migation button under Authentication methods** | Policies
   3.** External user are not able to register for MFA
   

Answer 1

Hello Watson Sileti

Thank you for reaching out to Microsoft Q&A.

It looks like you’ve run into a few “expected” quirks with a brand-new, free-tier Entra tenant. Let me walk through each of your points:

1. “Migrate off legacy MFA” banner
   • That banner is simply a heads-up that Microsoft is retiring per-user (legacy) MFA and SSPR policies in favor of the new “Authentication methods” policy by September 2025.
   • If you’ve never enabled legacy per-user MFA or SSPR in this tenant, there’s nothing to migrate today—so you won’t see a “Migrate now” button. You can safely ignore the banner until you actually have legacy settings to migrate (at which point the option will appear under Entra Admin center > Identity > Protection > Authentication methods > Settings).
2. No Migration button under Authentication methods > Policies
   • The portal only shows the migration toggle if it detects legacy per-user MFA or SSPR settings to convert. On a brand-new tenant with no per-user MFA activity, it simply won’t show up.
3. External (guest) users can’t register MFA
   • On the Free tier you don’t have Conditional Access, so you can’t force external users to register via a CA policy. Instead, you can leverage the built-in Email One-Time-Passcode (OTP) fallback for B2B guests who don’t have an Entra or Microsoft account. Here’s how to enable it:
     1. In the Entra Admin portal go to Identity > Protection > Authentication methods > Policies > Email OTP.
     2. Under the Enable and target tab, include All external users (or a specific guest group).
     3. Under Configure, set Allow external users to use email OTP to Enabled.
     4. Save.
   • After that, any guest who redeems an invitation and doesn’t have an existing Microsoft identity will receive a one-time code to their email and can use it to sign in.
   • If your invited users do have MSAs or Entra accounts, they’ll authenticate with their home‐tenant MFA. You can’t override that on Free tier.

If you still have trouble with external users not seeing a registration prompt, ask them to browse directly to https://mysignins.microsoft.com/security-info – they should be able to add Email OTP or any external authentication methods they’re targeted for.

—Hope that clears things up!

Reference Links

• Migrate legacy MFA & SSPR into Authentication methods policy: https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-methods-manage
• Email OTP for B2B external users: https://learn.microsoft.com/entra/external-id/one-time-passcode
• External MFA registration in Security info: https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-external-method-manage

If the answer is helpful, kindly upvote it. If you have extra questions about this answer, please click "Comment"

Answer 2

Hey there, Watson Sileti

Our newly created tenant does not use legacy MFA but I see an alert to migrate off legacy MFA

What you are seeing when you sign into your newly created tenant is expected, even if you haven't used legacy per-user Multi-Factor Authentication (MFA) methods. The notification banner 'Migrate off legacy MFA 'will display until the new MFA policy model has been fully rolled out on your tenant.

When logging into my account on Entra admin, I too see this alert on screen to migrate off legacy MFA. Providing your status is 'In progress' there is a way to speed up the migration process which I will show you how you can do this.

As you can see in the image above, my migration is currently in progress and I can view the Authentication method policies too.

To speed this up, when you see your migration status appear, please click onto begin automated guide

This will walk you through the new policies and what Microsoft recommends. Once it has done this, the message will be removed as migration has been completed.

You will also get the following notification

External users are not able to register for MFA

This could be due to guest users not being able to use any of the enabled authentication methods for them to use with their account. It may be worth checking what methods are available to users within the tenant here: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods/fromNav/

What error message do they get when they try and register MFA?

Hope this helps,
Nathan