How to edit Microsoft-managed policy

Question

How to edit Microsoft-managed policy

Matthew Castaldo 0

2025-11-10 10_31_43-Settings

I need to edit Microsoft-managed policies because I want to exclude a break glass account I have from needing two authentication methods - so that it's only a FIDO key as the sole authentication method.

I attached a photo of the error I receive. I am able to exclude the user I want, but cannot save the policy because there is no user or group selected in the "include" section.

I am a global admin so I'm not sure why this is greyed out for me. If anyone has anything they can share, it would be much appreciated. Thanks!

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-10T16:00:21.28+00:00

Matthew Castaldo Microsoft-managed policies cannot be fully edited; they are read-only. The "Include" area is grayed out as a result. Thus, Instead, make a custom policy. All users should be included, with the exception of your break glass account. Set up the break glass account to only utilize the FIDO key.
Matthew Castaldo 0 Reputation points

2025-11-10T16:02:52.7566667+00:00

Understood. So, I will just copy this policy exactly as is as a custom one, enable it, exclude my breakglass, then I will disable this Microsoft managed one.

I will give this a try. Thank you. Edited: I'm just realizing this policy isn't selecting any users so its not even being applied to anyone. What policy could be enforcing me to set up two methods of MFA??
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-10T16:44:44.1633333+00:00
Matthew Castaldo, Your Microsoft-managed policy isn't enforcing MFA if no users are chosen. The need for two MFA methods is probably a result of Security Defaults, which by default apply to the entire tenant.

To fix

Navigate to Azure AD → Properties → Manage Security Defaults.

This enforces MFA for all users if it is enabled. Disable Security Defaults and make a unique Conditional Access/Authentication Methods policy that is specific to your users in order to exempt your break-glass account. Forced MFA registration is typically caused by security defaults.

Let me know if any further queries- feel free to reach out!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-11T10:59:36.2566667+00:00

Matthew Castaldo Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-12T13:50:07.2+00:00

Matthew Castaldo Following up to see if the above provided information was helpful. If you have any further queries do let us know.

1 answer

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-10T16:00:21.28+00:00

Matthew Castaldo Microsoft-managed policies cannot be fully edited; they are read-only. The "Include" area is grayed out as a result. Thus, Instead, make a custom policy. All users should be included, with the exception of your break glass account. Set up the break glass account to only utilize the FIDO key.
Matthew Castaldo 0 Reputation points

2025-11-10T16:02:52.7566667+00:00

Understood. So, I will just copy this policy exactly as is as a custom one, enable it, exclude my breakglass, then I will disable this Microsoft managed one.

I will give this a try. Thank you. Edited: I'm just realizing this policy isn't selecting any users so its not even being applied to anyone. What policy could be enforcing me to set up two methods of MFA??
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-10T16:44:44.1633333+00:00

Matthew Castaldo, Your Microsoft-managed policy isn't enforcing MFA if no users are chosen. The need for two MFA methods is probably a result of Security Defaults, which by default apply to the entire tenant.

To fix

Navigate to Azure AD → Properties → Manage Security Defaults.

This enforces MFA for all users if it is enabled. Disable Security Defaults and make a unique Conditional Access/Authentication Methods policy that is specific to your users in order to exempt your break-glass account. Forced MFA registration is typically caused by security defaults.

Let me know if any further queries- feel free to reach out!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-11T10:59:36.2566667+00:00

Matthew Castaldo Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-12T13:50:07.2+00:00

Matthew Castaldo Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

2 deleted comments

Comments have been turned off. Learn more