What is the best practice for Guest Users MFA Reset, do they have option to reset their MFA?

Question

I am looking for best practice for multi factor authentication reset for guest users.

Is there a way we can enable them to do it their selves?

Answer 1

Dear @Joshi, Yash

For B2B guest users, there is no general self-service MFA reset option that allows them to reset their MFA registration after losing access to their authentication method. If the guest's authentication methods are managed in the resource tenant, they can manage their registered methods through Security info and, where supported by the configured policies, add or replace authentication methods themselves.

There is also another option for guests coming from another Microsoft Entra ID tenant. You can configure a cross-tenant access to trust the MFA claim from the guest's home tenant. In this scenario, the guest's MFA is authenticated and managed by their home tenant, so MFA registration, reset and maintenance remain the responsibility of the guest's home organization rather than the resource tenant. (Only works when guest coming from other Entra ID)

If a guest has completely lost access to their registered authentication methods, depending on where the authentication method is managed, the system administrator's intervention is still required.

Best regards,

Bence

Answer 2

I think guest MFA can’t be self‑reset so you ask the resource‑tenant admin to run Require re‑register MFA, and the guest can sign into their own org and open Security info for any method changes.

Answer 3

For guest users, the practical best practice is to separate MFA reset by an admin from self-service registration and password reset.

• Guest users can be required to re-register MFA by an admin in the resource tenant.
• Users can manage their own security methods through Security info.
• Users can reset their own password through self-service password reset, if that is enabled.

Recommended approach:

1. Use admin-driven MFA reset when a guest loses access to their MFA method
   • In the Microsoft Entra admin center, go to Entra ID > Users.
   • Select the guest user.
   • Open Authentication methods.
   • Choose Require re-register MFA.
   • This deletes the user’s phone numbers, Microsoft Authenticator apps, and software OATH tokens, and the user is prompted to set up a new MFA method at next sign-in.
2. Let users manage their own methods for normal maintenance
   • Users can update or reset their own security methods at Security info.
   • This is the self-service path for changing methods before they are locked out.
3. Enable backup methods for recovery
   • For customer/external scenarios, SMS can be enabled as an authentication method for self-service password reset.
   • Users must have their phone number registered as an MFA method.
   • Admins can enable SMS under Entra ID > Authentication methods > SMS, target All users or Select groups, acknowledge the terms, and save.
4. For B2B guest access, prefer reducing unnecessary resets
   • Microsoft Entra MFA for external users is performed by the resource tenant.
   • If guest users are repeatedly challenged or stuck re-registering, review cross-tenant trust and Conditional Access design so the tenant does not force avoidable re-registration.
5. Protect admin recovery paths
   • Exclude emergency access / break-glass accounts from Conditional Access policies to avoid lockout during MFA issues.

Best-practice summary:

• Yes, guest users have a limited self-service option: they can manage existing methods through Security info and use SSPR where enabled.
• No, the supported reset path after they are already locked out of MFA is typically admin action: Require re-register MFA.
• Best practice is to require guests to register more than one method where possible, allow self-service maintenance through Security info, and use admin reset only for recovery.

---

• Manage user authentication methods for Microsoft Entra multifactor authentication
• Enable self-service password reset
• Authentication and Conditional Access for External ID
• Require multifactor authentication for guest access
• MFA looping on Account Verification Code for Entra External ID Conditional Access triggered resource for Invited External User - Microsoft Q&A