How to disable the two factor authentication from single user.

I might post a video on how to do this. But basically Mohammed's method is the correct one.

Our issue as a business is that 85% of the users are Teams only. And of those 85%, about 95% don't understand MFA and are ALSO being asked to download an app that they don't understand.

The main reason is that the team is mostly technologically illiterate and the only time in their lives that they really use tech beyond visiting a website on their phone is to use Teams for communications.

So, right now, about 80% of our team is unreachable and turning of MFA has been an absolute nightmare.

You can achieve it via a conditional access policy for single user.

In my experience, the complete answer to this simple question is anything but straightforward. The exact process depends on a host of various factors in your environment, including what policies in place, admin permissions of the user executing the steps, additional Azure subscriptions, whether this is for an internal or external (guest) user, whether this is for a new user or an existing user, (if it an existing user) whether MFA has already been configured on the account, and much more.

The number of variables involved is probably why it is so hard to find a clear AND accurate answer to this seemingly-simple question that works for everyone.

With that said, for smaller organizations using Microsoft 365 Basic or Premium licenses who are trying to disable MFA for a user that has already registered for it, I think this GUI-only, non-PowerShell process might answer the question:

1. Disable Security Defaults for the organization. (If this is enabled, it acts as an “override all” and gives no flexibility to disable individual users, regardless of what you seem to see elsewhere in the admin environment.)
   1. https://portal.azure.com/#blade/Microsoft_AAD_ConditionalAccess/SecurityDefaults
   2. Alternatively, scroll to the bottom of this page and click the “Manage security defaults” link: https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Properties
2. Ensure that MFA is disabled for the user in question. 
   1. https://account.activedirectory.windowsazure.com/UserManagement/MultifactorVerification.aspx?BrandContextID=O365
   2. Optionally, ensure that MFA is enabled or enforced for all other users. (HIGHLY recommended!)
3. Revoke previous MFA configurations on the user.
   1. https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/~/AllUsers/menuId/
   2. Select the user from the list
   3. In the “Manage” section of the left menu for the user, select “Authentication methods”
   4. From the toolbar above the resulting pane, click “Revoke multifactor authentication sessions”. You may need to click the ellipsis (three dots) on the toolbar to view that choice.

Again, there are myriads of places to invoke policies and set other MFA-related settings, so this process will definitely not work for everyone's environment, but hopefully it provides some more clarity to someone.