External tenant: “Keep your account secure” returns BadRequest for an internal admin account — how should admins register MFA?

We have a Microsoft Entra External ID external tenant (customer configuration). Security defaults are enabled. There is one Conditional Access policy in report-only mode; the sign-ins we inspected show Conditional Access “Not applied.”

We created a cloud-only internal account on the tenant’s initial onmicrosoft.com domain—not an invited or federated account—and directly assigned it Global Administrator. It is intended for emergency access, but it is not usable yet because MFA registration fails.

Steps:

1. An existing administrator reset the account’s password.
2. We signed in to the Azure portal / Entra admin center in a private browser window.
3. The required password change succeeded.
4. An “Action Required” message stated that security defaults require MFA setup.
5. Selecting Next opened “Keep your account secure,” which returned “BadRequest.” No authentication methods were offered.
6. Another attempt in a fresh private window returned the same error.

What we observed:

• An interactive sign-in was interrupted for the required password change (50055), with authentication requirement “Multifactor authentication.”
• At the time of the first registration error, a non-interactive Microsoft App Access Panel sign-in failed with error 70008. Its correlation ID differs from the registration error’s correlation ID, so a causal connection is unconfirmed.
• The account has no registered authentication methods.
• Earlier self-service password-reset attempts failed because self-service password reset was not configured for this account. The subsequent administrator reset and password change succeeded.

The external-tenant feature comparison we reviewed lists MFA methods for self-service sign-up users and invited users, but we could not establish which registration methods apply to admin-created internal accounts.

Questions:

1. Is security-info registration through “Keep your account secure” / My Sign-ins supported for internal administrator accounts in an external tenant? If not, what is the supported way for these accounts to satisfy MFA with security defaults enabled?
2. Which methods are supported for these accounts: Microsoft Authenticator, passkey/FIDO2 security key, or Temporary Access Pass?
3. Is there a known cause or supported resolution for this BadRequest?

We want to keep security defaults enabled and avoid weakening existing protections. We can provide correlation IDs and timestamps through a private Microsoft support channel if needed.

Thanks.