How often does MFA per user authenticate in Entra ID Free plans?

Cooper Ruby 20 Reputation points
2026-08-10T00:02:57.0133333+00:00
  1. In the Entra ID Free environment, we disable the security defaults and manage MFA using "MFA per user". How often does MFA authentication come for users who are enrolled in MFA and have an enforced status? Also, can I set the authentication frequency?
  2. If a user who has previously registered MFA and has been disabled once is enforced by "Enable MFA", MFA authentication will not come again after many days. What could cause it? Also, what if you want to make MFA authentication come again or increase the frequency of authentication?
Microsoft 365 and Office | Install, redeem, activate | For business | Windows
0 comments
Answer accepted by question author
BabybooHN 3,040 Reputation points Independent Advisor
2026-08-10T00:28:15.9833333+00:00

Dear @Cooper Ruby,

I understand that you are using Microsoft Entra ID Free, with Security Defaults disabled, and are managing MFA through per-user MFA. You would like to know how frequently MFA is requested and whether the authentication frequency can be configured.

With per-user MFA, there is no fixed interval such as every 7, 30, or 90 days at which MFA is guaranteed to appear. When a user is in the Enforced state, MFA is required when Microsoft Entra determines that a new MFA authentication is required during sign-in. Microsoft states that per-user MFA causes users to perform MFA each time they sign in, although session persistence and the “remember MFA on trusted devices” behavior can prevent a new prompt from appearing every time.

Why might MFA not appear again after several days?

If the user previously registered MFA and you temporarily changed the user from Enforced/Enabled to Disabled, then enabled MFA again, the MFA registration itself is not necessarily removed. The user can still have a valid authentication/session state, so simply changing the per-user MFA status does not guarantee that the user will immediately receive a new MFA challenge.

I recommend checking the following:

  1. Confirm the user’s per-user MFA state
  2. Check whether the user still has registered MFA methods
    • Entra admin center > Entra ID > Users > [user] > Authentication methods.
    • Confirm that Microsoft Authenticator, phone, or another MFA method is still registered.
  3. Revoke the user’s existing sessions

From the user’s account, use Revoke sessions.

  • This is preferable when the objective is to force the user to authenticate again without deleting their MFA registration. Microsoft documents session revocation as an administrative control for this purpose.
  1. Check the sign-in logs
    • Review Entra ID > Monitoring & health > Sign-in logs.
    • Look at the Authentication requirement and authentication details to determine whether MFA was actually required, satisfied by an existing authentication claim/session, or not required for that sign-in. Microsoft also provides authentication-method usage reporting for this purpose.

Can I configure the MFA frequency in Entra ID Free?

This is the important limitation: per-user MFA in Entra ID Free does not provide a configurable “prompt for MFA every X hours/days” setting.

If your requirement is something like:

“Require users to perform MFA again every 24 hours / 7 days / 30 days.”

that is normally controlled using Conditional Access > Sign-in frequency, rather than the per-user MFA state. Microsoft documents Sign-in frequency as the control that determines how long a user can remain signed in before reauthentication is required.

However, Conditional Access requires Microsoft Entra ID P1/P2 (or a license that includes it), so it is not available as a configurable session-frequency control in a basic Entra ID Free-only setup.

Therefore, if you must have a predictable MFA reauthentication interval, I would recommend moving to a license that includes Microsoft Entra ID P1 and using a Conditional Access policy with Sign-in frequency.

For your current Entra ID Free configuration, the practical approach is:

Per-user MFA = Enabled/Enforced > user completes MFA > existing authentication/session state may satisfy subsequent access > revoke sessions when you need to force reauthentication.

Microsoft documentation:

I hope this clarifies why MFA is not necessarily prompted again simply because several days have passed, and why per-user MFA itself cannot be configured with a specific MFA frequency.

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in the forum document to enable e-mail notifications if you want to receive the related email notification for this thread.

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-08-10T00:03:12.1+00:00

    In Microsoft Entra ID Free, per-user MFA can still be used when Security Defaults are disabled. For authentication frequency, the documented default sign-in frequency is a rolling window of 90 days for Office clients when no session lifetime settings are configured.

    For browser sign-ins, MFA prompt behavior depends on session settings:

    1. If Remember multifactor authentication is enabled, the MFA bypass period can be set from 1 to 365 days.
    2. This feature sets a persistent browser cookie when the user selects Don’t ask again for X days.
    3. If the cookie expires, is cleared, or the user signs in from a different browser, MFA is prompted again.
    4. On non-browser modern authentication apps, the Don’t ask again option is not shown. Microsoft Entra ID instead checks whether the last MFA occurred within the configured number of days.

    In Entra ID Free, the recommended reauthentication control is generally Show option to remain signed in. If Microsoft Entra ID P1 or P2 is available, the recommended way to control authentication frequency is Conditional Access Sign-in frequency.

    For the second scenario, if a user was previously registered for MFA, then disabled, and later re-enabled, one documented cause is the user state:

    • Per-user MFA has Disabled, Enabled, and Enforced states.
    • When MFA is re-enabled for a user, the state might not automatically transition from Enabled to Enforced if the user does not re-register.
    • In that case, the administrator must move the user directly to Enforced.

    Other documented reasons MFA may not appear again include:

    • Remember multifactor authentication is enabled and the remembered period has not expired.
    • The device/browser still has the persistent cookie.
    • MFA is being skipped for trusted IP addresses.

    To make MFA prompt again or increase prompt frequency:

    1. Review Entra ID > Users > Per-user MFA > Service settings.
    2. Check whether Remember multifactor authentication is enabled.
    3. If it is enabled, reduce the number of days or disable it.
    4. Be aware this can increase prompts, especially for modern authentication clients such as Office apps.
    5. If an account or device is compromised, revoke sessions because this removes trusted status from devices and forces MFA again.

    Important behavior to note:

    • If both Show option to remain signed in and Remember multifactor authentication are enabled, the most restrictive setting determines when reauthentication happens.
    • Using Remember multifactor authentication with a value lower than 90 days can increase MFA prompts for Office clients.
    • Microsoft recommends 90 days or less if using the remember MFA feature.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.