The necessary applications for MFA exclusion have not been added to the Generic User account or Azure AD Group

The screenshot shows that the user object has no enterprise app assignments, but MFA exclusions for Conditional Access do not depend on assigning applications to the user or group. MFA exclusions are configured directly in Conditional Access policies.

To exclude a generic user account or Azure AD group from MFA, configure the exclusion in the Conditional Access policy that enforces MFA, rather than trying to add applications under the user:

1. In the Microsoft Entra admin center, go to Protection → Conditional Access → Policies.
2. Edit the policy that requires MFA (for example, a policy created from templates such as Require multifactor authentication for all users, Require multifactor authentication for Azure management, Require multifactor authentication for device registration, or guest MFA policies).
3. In Assignments → Users and groups:
   • Under Include, select the users/groups that should be subject to MFA.
   • Under Exclude, add the specific generic user account or Azure AD group that must be exempt from MFA.
4. Save the policy.

Microsoft guidance is to keep exclusions minimal and to use them mainly for:

• Emergency access or break-glass accounts, so administrators are not locked out by misconfigured policies.
• Service accounts and service principals, where MFA is not appropriate and Conditional Access for workload identities should be used instead.

If using the Microsoft 365 MFA setup templates, note that during template creation the current admin account is automatically excluded and cannot be changed at that step. After the policy is created, adjust the Excluded users list to contain only the intended emergency access accounts and any other justified exclusions.

There is no requirement to add specific applications to the user or group for MFA exclusion; the Conditional Access policy assignments alone control whether MFA is enforced or bypassed for that identity.

References:

• Require MFA for Azure management
• Require multifactor authentication for all users
• Require multifactor authentication strength for external users
• Require multifactor authentication for guest access
• Require multifactor authentication for device registration
• Set up multifactor authentication for Microsoft 365
• Mandatory multifactor authentication for Azure and admin portals
• System-preferred multifactor authentication - Authentication methods policy