Aufforderung zur Anlegung des MFA obwohl dieser schon aktiviert ist

Question

Aufforderung zur Anlegung des MFA obwohl dieser schon aktiviert ist

Frederik Rier 41

Hello everyone, based on the CIS Benchmark, I created a few Conditional Access policies. These policies are intended to trigger MFA, but not on a permanent basis.

Issue description: Every time I log in, I have to enter my MFA once. After that, I have to confirm my device for MFA approval. Once confirmed, I am taken back to the login screen, log in again, and then I have to confirm my MFA device once more.

Here is a Screenshot:

Benutzerbild

My CA-Policies:

Overview: Benutzerbild

MFA for administrative roles:

Benutzerbild

MFA for all users:

Benutzerbild

Has anyone an Idea why this is happening?

Thank you,

xxxxx

0 Kommentare

Antwort, die vom Frageautor angenommen wurde

0 zusätzliche Antworten

Ihre Antwort

Answer 1

Vivian-HT 17,900 Externe Microsoft-Mitarbeiter Moderator

Since you wrote your question in English, I will also provide the answer in English, even though the portal interface appears in German.

Dear @Frederik Rier,

Thank you for posting your question in the Microsoft Q&A forum.

According to your audit logs and screenshots. After reviewing the entries, we noticed repeated MFA-related callbacks (POST UserAuthMethodSecurityInfoRegistrationCallback) and multiple updates to user security information. Moreover, please noted that Admins will always be prompted for MFA at least once per session (by design)

However, repeated prompts after successful login strongly suggests that the issue is not a failure of MFA itself, but rather:

Overlapping Conditional Access policies (e.g., MFA for all users and MFA for administrative roles both applying to the same account).
Missing session persistence settings, which causes Azure AD to treat each login as a new session.

Before giving you the best solution, could you please confirm these questions below to help me diagnose the issue more effectively:

Are repeated MFA prompts happening for all users, or only for administrative accounts?
Since you are using business account, are you the admin in your company?

In the meantime, here are some steps I recommend you try which helping for narrowing down and investigating the issue:

Step 1. Use the “What If” Tool

The Conditional Access What If policy tool helps you understand the result of Conditional Access policies in your environment. It can be useful when simulating uncommon scenarios, enabling you to design more comprehensive security policies. Instead of manually testing your policies with multiple sign-ins, this tool helps you simulate a sign-in for a user or service principal. The simulation estimates how your policies affect this sign-in and generates a report.

You can find the What If tool in the Microsoft Entra admin center > Entra ID > Conditional Access > Policies > What If, simulate sign-in for the affected user to confirm which policies apply.

For more information, please refer to Troubleshoot Conditional Access Policies with the What If Tool (English) and Beheben von Problemen mit Richtlinien für bedingten Zugriff mit dem What-If-Tool (German)

Step 2. Exclude Users to Narrow Down

Temporarily exclude the affected user from one policy at a time to narrow down which one (For example: Start with MFA for all users. Then test with MFA for administrative roles).
Observe if repeated MFA stops after excluding a specific policy.

Step 3. Check Regular User Behavior

Test with a non-admin account:

If regular users only see MFA once, the issue is specific to admin policies.
If they also experience repeated MFA, session settings need adjustment.

Step 4. Configure Session Controls

Add Sign-in frequency (e.g., 90 days) and Persistent browser session to your CA policies.

For more information, please refer to Conditional Access: Session (English) and Bedingter Zugriff: Sitzung (German).

Step 5. Enable “Remember MFA on Trusted Devices”

For more information, please refer to Microsoft Entra recommendation: Minimize MFA prompts from known devices (English) and Microsoft Entra -Empfehlung: Minimieren von MFA-Eingabeaufforderungen von bekannten Geräten

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.

Please understand that our initial response does not always resolve the issue immediately. However, with your help and more detailed information, we can work together to find a solution.

Thank you for your patience and your understanding. If you have any questions, please feel free to reach out.

I'm looking forward for your reply.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Antwort akzeptieren01 Antwort

Vivian-HT 17,900 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2025-10-22T06:56:44.4966667+00:00

Dear @Frederik Rier,

Good day and I hope you're doing well. I just wanted to check in and see if there is any update from you

If you're still facing any problems, please feel free to share more details about the current error or steps you're stuck on. I’ll be happy to assist further.

Looking forward to your update.
Frederik Rier 41 Zuverlässigkeitspunkte

2025-10-22T14:31:40.91+00:00

Hi Vivian,

thank you for your fast support.

Are repeated MFA prompts happening for all users, or only for administrative accounts?

The Issue appears for normal users and also for administrative users. Ive tested it with a non priviliged account.

Since you are using business account, are you the admin in your company?

This ist just a Test-Environment

"Missing session persistence settings, which causes Azure AD to treat each login as a new session."

ive added "Persistent browser session" Settings in the Policy

Step 1. Use the “What If” Tool

For some Reasons the What If Tool shows me that no CA Policy is applied when i try to access the M365 Admin Portal or the M365 User Portal with my user although I have also set Global Administrator as a scope in the policy.

Step 4. Configure Session Controls

Add Sign-in frequency (e.g., 90 days) and Persistent browser session to your CA policies.

Done but only for 8 hrs.

Step 5. Enable “Remember MFA on Trusted Devices”

Done but i saw that that MFA is disabled for every user at the moment

Im a little bit confused to be honest.

Do you have an Idea?

BR,

Frederik
Frederik Rier 41 Zuverlässigkeitspunkte

2025-10-22T14:51:19.2733333+00:00

Update:

I found something interesting under the Sign-In Logs:

But im not able to provide password reset information. Here is the Process:

Log in to the Portal:

Ive got this Message:

I click on "Next" and than this Window appears:

This Window appears again:

This Window appears again:
Vivian-HT 17,900 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2025-10-23T06:25:42.6+00:00
Dear @Frederik Rier,

Thank you for your update!

The message in Additional Details means the account is being interrupted by Security Info registration or password reset requirement enforced by Azure AD. It’s not a Conditional Access setting; it might be coming from Authentication Methods policy or Self-service Password Reset (SSPR) configuration.

According to my research, you could try these steps:

Option 1: Complete Registration

Sign in interactively and provide the required security info (phone, email, or app).

On your computer, go to the Security info page of your MySign-ins dashboard. Select +Add sign-in method and follow the prompts to add another way to verify it's you. https://mysignins.microsoft.com/security-info. For reference: Verifying your identity when signing in

Sign in to the Microsoft Entra admin center as at least an Authentication Administrator > Browse to Entra ID > Users > Choose the user for whom you wish to add or change an authentication method and select Authentication methods > At the top of the window, select + Add authentication method. For more information: Manage user authentication methods for Microsoft Entra multifactor authentication

Option 2: Disable Security Default for MFA

The feature "security defaults" might be enabled in your Azure AD. Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults.

Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.

Browse to Entra ID > Overview > Properties.

Select Manage security defaults.

Set Security defaults to Disabled

Select Save.

For more information: Security defaults in Microsoft Entra ID

Option 3: Reset the User

If stuck in a loop, try to reset the user’s authentication methods: Microsoft Entra admin center > Users > Authentication methods > Delete existing methods. Then allow re-registration.

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.

Thank you for your patience and your understanding. If you have any questions, please feel free to reach out.

I'm looking forward for your reply.
Vivian-HT 17,900 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2025-10-24T07:09:57.9533333+00:00

Dear @Frederik Rier,

Good day and I hope you're doing well. I just wanted to check in and see if there is any update from you.

If you're still facing any problems, please feel free to share more details about the current error or steps you're stuck on. I’ll be happy to assist further.

Looking forward to your update.
Vivian-HT 17,900 Zuverlässigkeitspunkte Externe Microsoft-Mitarbeiter Moderator

2025-10-28T07:22:39.14+00:00

Dear @Frederik Rier,

I hope this message reached you.

This is my second time reaching out to check if there is any update from you. I really want to make sure your experience is as smooth as possible. If your issue persists or if you encounter any new difficulties, please share more details about the current steps you are taking. I am always happy to assist you whenever you need.

While waiting for your response, I will also be monitoring other customer questions on the forum to assist them. If you have any further questions or updates, please tag (@Vivian-HT) in the reply so I can assist you more promptly and thoroughly.

I look forward to hearing from you soon.