Disable per-user MFA for every user

Description

No user has the per-user MFA state Enabled or Enforced: every user shows Disabled, and MFA is required by Conditional Access (CB-M365-AUTH-003) or, without Entra ID P1, by security defaults (CB-M365-AUTH-002).

The per-user MFA service settings are not used either: app passwords are not allowed, trusted IPs are empty and remember multifactor authentication on trusted devices is off.

Microsoft can create a Microsoft-managed Conditional Access policy for per-user MFA users (tenants with fewer than 500 of them). It helps the transition but does not remove the per-user state.

Rationale

Per-user MFA predates Conditional Access. It cannot target applications, devices or risk, ignores authentication strengths, and with the Enforced state lets users create app passwords that bypass MFA for legacy clients. Mixing it with Conditional Access gives prompts nobody can explain and hides gaps.

Impact

Make sure Conditional Access requires MFA for these users before switching them to Disabled, otherwise they lose MFA. Existing app passwords stop working once the user is no longer enforced and app passwords are disallowed.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader (the portal page may require Authentication Policy Administrator; use the Graph call otherwise).
2. Browse to Entra ID > Users > All users and select Per-user MFA.
3. Filter Status on Enabled, then on Enforced.
4. Select service settings and check app passwords, trusted IPs and remember MFA.
5. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All), per user: Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/users/$id/authentication/requirements" returns perUserMfaState.
6. Fail if any user is Enabled or Enforced, or if app passwords are allowed.

Remediation

1. Confirm that the Conditional Access MFA policy covers the users found.
2. As at least an Authentication Policy Administrator, browse to Entra ID > Users > All users > Per-user MFA.
3. Select the users in Enabled or Enforced and select Disable MFA, then confirm.
4. In service settings, select Do not allow users to create app passwords, clear trusted IPs and remember MFA, and save. Graph equivalent, per user: PATCH https://graph.microsoft.com/beta/users/{id}/authentication/requirements with {"perUserMfaState": "disabled"}.

Rollback

Set the users back to Enabled in Per-user MFA.

References

• Enable per-user Microsoft Entra multifactor authentication to secure sign-in events Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft-managed policies Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-AUTH-003 Require MFA for all users on all resources
• related CB-M365-AUTH-009 Complete the migration to the Authentication methods policy
• related CB-M365-AUTH-046 Block the legacy MSOnline PowerShell module from the tenant

People and lifecycle