Forum Discussion
Solved
MFA registration is asked even if it is set off everywhere
Hello I have a user, that had previously MFA set up. I removed the MFA method from his settings. When he logs in, he got's a prompt to set up MFA. MFA is disabled per user. And there i...
Yes, seems that the issue is solved. SSPR was on for all users of the tenant.
I went on the registration prompts and set it up. After that the prompt has not been shown and still no MFA is required when logging in. I probably mixed MFA registration prompt and SSPR registration prompt. Sorry for the confusion and thank you for your helpful efforts! I hope this can help also others wondering the same thing.
Regards,
Pekka
Hello Pekka-Pek. So few things to check, is this a recent tenant with Security Defaults enabled? This may enforce MFA in certain cases. If Security Defaults is not enabled, and no Conditional Access policy exists that forces MFA, the only other option I can think of is the per user MFA setting. Once it is enabled for a user, it will turn to "enforced", and could cause the user to now be prompted continuously. When changing the per-user MFA, there's actually a 'disable' option, have you tried this?
pvanberlo thank you for the suggestions.
To me it seems that the per user MFA is turned off for this specific user.
Regards,
Pekka
- I would check what the output is using PowerShell and if necessary remove the StrongAuthenticationRequirement there.
Get-MsolUser -UserPrincipalName <username> | Set-MsolUser -StrongAuthenticationRequirements @()Thanks for the quick reply. I checked it out right away, but it seems to be also empty.
I also tried to toggle MFA required to enable and back to disabled state.
But the problem seems to prevail.
It also come to my mind that could the prompt come from self service password reset. I have to check that later, but it will go probably next week.
Regards,
Pekka
- Ah yes. SSPR could also be causing such prompts.
