User is being prompted for MFA when accessing Azure Portal (portal.azure.com), but MFA approval is not received on Microsoft Authenticator. Observations: - Per-user MFA is disabled - Security Defaults are disabled - No Conditional Access policy is applie

Rockey Reddy Variyala 0 Reputation points
2026-05-01T15:32:13.4533333+00:00

Observations: - Per-user MFA is disabled - Security Defaults are disabled - No Conditional Access policy is applied (verified in sign-in logs) - Microsoft Authenticator policy is disabled - User has no admin roles - MFA works correctly for Office 365 login - Only Azure Portal login is impacted - User is hybrid (AD synced) Troubleshooting already done: - Cleared all authentication methods - Required re-registration of MFA - Revoked sessions - Reinstalled Microsoft Authenticator app - Reset password from on-prem AD and synced - Tested via incognito browser - Verified no Conditional Access enforcement (shows "Not applicable") Issue: Azure Portal still enforces MFA with number matching, but no push notification is received on mobile device. Request: Please check backend MFA enforcement / stale authentication state and reset MFA registration for the user at tenant level.

Microsoft Security | Microsoft Authenticator
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-05-01T15:32:28.98+00:00

    The behavior is caused by Azure enforcing multifactor authentication for access to Azure and admin portals independently of per-user MFA, Security Defaults, or Conditional Access configuration. This enforcement is tenant-level and cannot be turned off or bypassed, and it can require Microsoft Authenticator with number matching even when no explicit MFA policy is visible in the tenant configuration.

    Key points:

    1. Mandatory MFA for Azure/admin portals
      • Azure has a mandatory MFA requirement for users accessing Azure and admin portals.
      • This requirement is enforced even if:
        • Per-user MFA is disabled.
        • Security Defaults are disabled.
        • No Conditional Access policy is applied.
      • There is no way to opt out of this enforcement.
    2. Why Office 365 sign-in works but Azure Portal does not
      • The mandatory MFA enforcement specifically targets Azure and admin portals.
      • Office 365 workloads can still succeed with the existing MFA configuration, while Azure Portal access triggers the stricter, enforced MFA experience (including number matching with Microsoft Authenticator).
    3. What can be changed
      • Global Administrators can only postpone the start date of this enforcement for the tenant; they cannot disable it.
      • Postponement requires:
        • Global Administrator role.
        • Elevated access enabled.
        • Using the dedicated management page referenced in the documentation.
    4. Why “backend reset” will not remove the requirement
      • Clearing authentication methods, requiring re-registration, revoking sessions, reinstalling the app, and password resets all affect the user’s registered methods, but not the platform-level mandatory MFA requirement for Azure/admin portals.
      • Even if MFA registration is fully reset and redone, Azure Portal will still require MFA; the most that can be changed is which methods are available and correctly registered.
    5. Next actions for the tenant admin
      • Ensure the user has a working Microsoft Authenticator registration (including push notifications and number matching) by:
        • Requiring re-register MFA from Microsoft Entra admin center (already done, but must be completed successfully by the user during sign-in).
      • If push notifications still do not arrive after re-registration, use alternative verification options if available (phone, SMS, or code from the app) and verify that the device and app can receive notifications.
      • If the tenant wants more time to prepare for this enforcement, a Global Administrator with elevated access can postpone the enforcement start date for the tenant using the documented management page.

    Because this MFA requirement is mandatory for Azure/admin portals, backend support cannot remove or disable it at the tenant level; only postponement is possible, and the user must have at least one working MFA method to access Azure Portal.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.