Hey everyone! I'm the system admin at a school, and I'm trying to set up some accounts without requiring two-factor authentication (2FA) using the Microsoft app. I attempted to disable the 2FA option at the account level, but it didn't work. Even after turning off 2FA for the entire organization, it still prompts for it during the first login. Has anyone faced this issue or knows how to fix it? Any help would be greatly appreciated!
3 Answers
Just a heads up, Microsoft started phasing out the option to use basic authentication with username/password in February. You can turn it on for your organization, but it’s only temporary until the end of April. After that, you’ll need to implement 2FA like an app or a certificate.
Disabling that for certain accounts might not work if Security Defaults are enabled. These settings are applied across the tenant, which means they override any individual account settings. You’ll want to go to Microsoft Entra ID > Properties > Manage security defaults and turn that off. Just keep in mind, Microsoft prefers to keep it on for security reasons, but in a school setting, it's understandable if it's a hurdle.
You might want to check out Conditional Access Policies. Create a group like "CAP_NoMFA" and add the service accounts that don’t need MFA to that group. Then, apply a Conditional Access Policy to that group to specify that MFA isn't required.
That’s a good point! With many schools forced to limit cellular devices, some 2FA methods just won’t fly. Options like passkeys or YubiKeys are either too complicated or too costly for large-scale deployment in schools.