New User cannot register an authenitcation method

Question

New User cannot register an authenitcation method

Matt Portt 0

We have created a new user and on first sign in to the reset PC after entering the password and clicking through the screen to set up MFA the message is "Contact your admin - You are required to register an authentication method to continue but none have been enabled for this account. Contact your admin for help."

We had a long standing policy that required Microsoft authenticator for MFA and this appears as enabled for the user but we cannot pass this screen

VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2025-12-18T16:26:13.19+00:00

Hello Matt Portt,

This error occurs when the user is required to register MFA, but no authentication methods are actually available to them at sign-in time.

Even though Microsoft Authenticator appears enabled, the account is blocked because the effective MFA configuration does not allow any usable method for first-time registration

What’s happening

Conditional Access requires MFA.

Security defaults / Authentication Methods policy does not allow any method for this user (or Authenticator registration is restricted).

During first sign-in (PC reset / OOBE), the user must register MFA, but Entra ID finds zero permitted methods, so it fails with this message.

How to fix

In Entra ID → Protection → Authentication methods, confirm:

Microsoft Authenticator is enabled

The user is included (not excluded by group scope)

Temporarily enable an additional method (e.g. SMS or Temporary Access Pass) to allow first sign-in.

If using Authentication method restrictions, ensure Authenticator is allowed for registration, not just authentication.

Have the user sign in again and complete MFA registration, then remove any temporary methods if required.

Once at least one MFA method is truly available for registration, the user will be able to proceed past this screen.
Watson Sileti 0 Reputation points

2026-05-09T14:41:09.9166667+00:00

I am having tha same issue as @Matt Portt . Was this issue resolved.
I have 3 methods enabled and no exclusions. But still external users cannot register for MFA

@Matt Portt , how did you fix the issues you were getting.

Your answer

VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2025-12-18T16:26:13.19+00:00

Hello Matt Portt,

This error occurs when the user is required to register MFA, but no authentication methods are actually available to them at sign-in time.

Even though Microsoft Authenticator appears enabled, the account is blocked because the effective MFA configuration does not allow any usable method for first-time registration

What’s happening

Conditional Access requires MFA.

Security defaults / Authentication Methods policy does not allow any method for this user (or Authenticator registration is restricted).

During first sign-in (PC reset / OOBE), the user must register MFA, but Entra ID finds zero permitted methods, so it fails with this message.

How to fix

In Entra ID → Protection → Authentication methods, confirm:

Microsoft Authenticator is enabled

The user is included (not excluded by group scope)

Temporarily enable an additional method (e.g. SMS or Temporary Access Pass) to allow first sign-in.

If using Authentication method restrictions, ensure Authenticator is allowed for registration, not just authentication.

Have the user sign in again and complete MFA registration, then remove any temporary methods if required.

Once at least one MFA method is truly available for registration, the user will be able to proceed past this screen.
Watson Sileti 0 Reputation points

2026-05-09T14:41:09.9166667+00:00

I am having tha same issue as @Matt Portt . Was this issue resolved.
I have 3 methods enabled and no exclusions. But still external users cannot register for MFA

@Matt Portt , how did you fix the issues you were getting.