MFA Disabled but still requiring

MFA can appear disabled in one place but still be enforced because the effective requirement comes from elsewhere. Common causes and checks:

1. User is a guest in another tenant
   If the account is a guest in another Microsoft Entra tenant, MFA behavior is controlled by the user’s home directory, not the guest directory. In that case:
   • The guest tenant may show the user as “disabled” for MFA, but
   • Sign-in still follows the MFA status and policies in the home tenant.
     To actually change MFA behavior, update the user’s MFA status and policies in the home directory.
2. Conditional Access or security defaults still require MFA
   Even if per-user MFA is disabled, MFA can still be required by:
   • Security defaults (which enforce MFA for all users), or
   • Conditional Access policies that require MFA based on group membership, app, location, or role (for example, for admin roles).
     If any Conditional Access policy or security defaults are enabled and target this user, sign-in will still prompt for MFA.
3. Default MFA method still in use via NPS extension / RADIUS
   If the environment uses the NPS extension for Microsoft Entra multifactor authentication (for VPN, RD Gateway, etc.), the extension always invokes the user’s default MFA method when policy requires MFA. The user can’t choose an alternative method at that point.
   If MFA is still required by policy, the NPS extension will continue to send MFA requests even if it appears disabled elsewhere.

To resolve:

1. Confirm whether the account is a guest in another tenant; if so, change MFA in the home tenant.
2. Check whether security defaults are enabled or any Conditional Access policy requires MFA for this user (for example, because of admin roles or group membership).
3. If using NPS extension/RADIUS, review which sign-ins are protected by MFA and adjust policies or methods accordingly.

References:

• A user is displayed as disabled or enabled for Microsoft Azure Multi-Factor Authentication but behaves as the opposite
• Step 3: Protect your Microsoft 365 user accounts
• Migrate from MFA Server to Microsoft Entra multifactor authentication