Admins continually prompted to setup additional MFA Authentication, but it states they connect

The behavior matches a policy-driven requirement to collect or update password reset/MFA information (for example, SSPR/MFA registration) rather than a break in the existing methods.

The sign-in log message is key:

"User authentication was blocked because they need to provide password reset information. Their next interactive sign in will ask them for this, which the app should trigger next."

This indicates that:

• Microsoft Entra ID is enforcing registration of password reset/MFA information.
• The app or flow used for sign-in is not successfully completing the required registration step, so users are repeatedly blocked and prompted.

From the provided context, combined registration and SSPR/MFA policies interact as follows:

• Combined registration uses three policies to decide which methods to show in Add method:
  1. Self-service password reset (SSPR)
  2. MFA
  3. Authentication methods
• If a method is enabled in any of these policies, it can appear in the registration experience, even if disabled in another.

This can cause repeated prompts if:

• SSPR requires certain methods that admins have not fully registered, or
• There is a mismatch between SSPR, MFA, and Authentication methods policies, so the portal keeps asking for methods that are still considered missing.

Recommended actions:

1. Review SSPR policy
   • In the Microsoft Entra admin center, open the Self-service password reset settings and verify:
     • Which users/groups are enabled for SSPR.
     • How many methods are required to register and reset.
     • Which methods are allowed.
   • If admins are required to register more methods than they actually have configured, they will be forced back into registration.
2. Review MFA and Authentication methods policies
   • Check the MFA policy and Authentication methods policy:
     • Ensure the methods required for SSPR are also allowed in MFA/Authentication methods.
     • Avoid conflicts where a method is disabled in one policy but required in another, which can keep registration in an incomplete state.
3. Confirm combined registration behavior
   • Because combined registration uses all three policies, verify that the set of required methods is realistic and that admins can complete registration in one go.
   • If a method is shown but cannot be completed (for example, disabled elsewhere or not applicable), reduce the required number of methods or adjust allowed methods so registration can complete successfully.
4. Test with a single admin
   • Temporarily reduce the required number of methods for the affected admin group.
   • Have one admin sign in via a browser, complete the registration experience fully, and then sign out and back in to confirm prompts stop.

If, after aligning SSPR, MFA, and Authentication methods policies, admins still see repeated prompts, an administrator should:

• Review the detailed sign-in logs for one affected admin to confirm that the block reason remains “need to provide password reset information” and not a different MFA or Conditional Access condition.

References:

• Troubleshoot self-service password reset in Microsoft Entra ID
• What is Microsoft Entra authentication?