Why does Microsoft Entra Login not show which tenant is selected for MFA prompt?

Sid Merrett 0 Reputation points
2026-03-24T08:59:14.85+00:00

This has been true forever and is a real problem in multi tenant environments.
If a browser session becomes dormant or for whatever reason, MFA has to be re-entered to login.
Currently, it is not shown which tenant was last accessed and therefore which MFA code is being prompted for when using third party (non-Microsoft authenticator)
So if you have tenants 1 to 10, each with MFA configured by default and with different MFA profiles/codes - you cannot know (unless you happen to remember) which of these tenants was last logged because it isn't displayed in the prompt.

How are we supposed to just remember what tenant was last logged in, in order to enter the correct MFA code for that tenant?
The reason we are using third party authenticator, is because others offer BACKUP of the configured MFA profiles. Microsoft Authenticator does not.

Microsoft Security | Microsoft Entra | Microsoft Entra ID

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-03-24T08:59:34.4933333+00:00

    Microsoft Entra sign-in and MFA prompts are designed around the user account and session context, not around clearly surfacing the specific tenant being accessed at the time of the MFA challenge. The behavior described (MFA prompt not indicating which tenant’s policy or code is in effect) is a limitation of the current UX and is not configurable from the available settings in the provided material.

    What can be influenced from the admin side is how often and under what conditions MFA prompts appear, which can reduce how frequently this ambiguity occurs:

    1. Use Conditional Access for sign-in frequency and sessions (P1/P2 tenants)
      • For tenants with Microsoft Entra ID P1 or P2, configure Conditional Access policies for Sign-in frequency and Persistent browser session instead of relying on overlapping legacy settings. This helps control when reauthentication and MFA are required and avoid excessive or unexpected prompts.
      • Guidance recommends:
        • Enable SSO via managed devices or seamless SSO.
        • Use Conditional Access Sign-in frequency for reauthentication.
        • Optionally use Conditional Access to enable persistent browser sessions with appropriate durations.
    2. Avoid overlapping legacy/session settings that increase prompts
      • If multiple session-related settings are enabled (for example, Remember multifactor authentication plus Show option to remain signed in), the most restrictive policy wins and can cause more frequent MFA prompts, which exacerbates the tenant-identification problem.
      • Recommended patterns:
        • For P1/P2: rely on Conditional Access (Sign-in frequency + persistent browser sessions).
        • For Microsoft 365 Apps / Entra ID Free: use Show option to remain signed in and guide users to accept Stay signed in?.
    3. Review and simplify token lifetime and session policies
      • Use Microsoft Graph PowerShell to review existing token lifetime policies and disable legacy/configurable token lifetime policies where possible, then move to Conditional Access for session control.
      • Without additional session lifetime settings, browser sessions are non-persistent and will prompt again after closing the browser; Office clients use a rolling 90‑day window. Adjusting policies to a more predictable pattern can reduce surprise MFA prompts.
    4. Use managed devices to reduce prompts across apps
      • Devices joined to Microsoft Entra ID (Entra join or hybrid join) receive a Primary Refresh Token (PRT) that provides SSO across applications, reducing the number of separate MFA prompts per device.

    These measures do not change the fact that the MFA prompt itself does not display the tenant name, but they can significantly reduce how often users are forced into guessing which tenant’s MFA profile applies.

    For the specific UX gap (no tenant indication on the MFA prompt, especially when using third‑party authenticators), the available documentation does not provide a configuration or workaround that would cause the tenant name to be displayed. Addressing that would require a product change and should be raised as feedback through Microsoft support or feedback channels.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.