Disabling Microsoft Authenticator for test accounts in Microsoft Entra ID

Question

Disabling Microsoft Authenticator for test accounts in Microsoft Entra ID

Jakub Śliwiński 0

In Azure, I have provisioned a couple test accounts in Microsoft Entra ID to test some RBAC features. When I'm trying to log on these test accounts for the first time, I'm always getting asked to set up the Microsoft Authenticator app for them. But since these are just temporary test accounts, I don't think this should be necessary. Is there any way to turn this off for them?

Sridevi Machavarapu 30,450 Reputation points Microsoft External Staff Moderator

2026-05-20T22:48:16.0866667+00:00
Hello Jakub Śliwiński,

Yes, this can be turned off for test accounts.

The prompt is typically caused by either:

Security Defaults being enabled, or

A Conditional Access / Authentication Methods policy requiring MFA registration.

You can check this in:

Microsoft Entra admin center → Identity → Overview → Properties → Manage security defaults

If Security Defaults are enabled, all users will be asked to register Microsoft Authenticator.

If you are using Conditional Access, the recommended approach is to place your test accounts in a separate group and exclude that group from:

MFA policies

Authentication methods policies

Registration campaigns

You should also review:

Protection → Authentication methods → Registration campaign

as this setting can specifically prompt users to set up Microsoft Authenticator during sign-in.

1 answer

Your answer

Sridevi Machavarapu 30,450 Reputation points Microsoft External Staff Moderator

2026-05-20T22:48:16.0866667+00:00

Hello Jakub Śliwiński,

Yes, this can be turned off for test accounts.

The prompt is typically caused by either:

Security Defaults being enabled, or

A Conditional Access / Authentication Methods policy requiring MFA registration.

You can check this in:

Microsoft Entra admin center → Identity → Overview → Properties → Manage security defaults

If Security Defaults are enabled, all users will be asked to register Microsoft Authenticator.

If you are using Conditional Access, the recommended approach is to place your test accounts in a separate group and exclude that group from:

MFA policies

Authentication methods policies

Registration campaigns

You should also review:

Protection → Authentication methods → Registration campaign

as this setting can specifically prompt users to set up Microsoft Authenticator during sign-in.

Answer 1

AI answer

Disable Microsoft Authenticator (MFA) only for the specific test accounts by using Conditional Access, instead of turning it off tenant-wide.

From the context:

User-based authentication scenarios that cannot work with MFA are handled by disabling MFA only for the test accounts and only in test environments.
Disabling security defaults or MFA globally is explicitly discouraged because it affects all users.

Actionable approach:

Keep tenant-wide MFA/security defaults enabled for normal users.
Create or adjust a Conditional Access policy in Microsoft Entra ID that excludes the specific test accounts (or a dedicated test group) from MFA requirements in the test environment.
Use these test accounts for RBAC testing; they will no longer be forced to register Microsoft Authenticator when signing in.

This way, only the designated test accounts bypass MFA/Authenticator, while security remains enforced for all production users.

References:

User-based authentication

AI-generated content may be incorrect. Read our transparency notes for more information.

Share via

Disabling Microsoft Authenticator for test accounts in Microsoft Entra ID

1 answer

Your answer