organisation level users are getting MFA authenticator request multiple times while opening each app on different tabs?

Sampath Bhonsle 0 Reputation points
2026-10-23T09:11:04.8466667+00:00

How to fix organisation level MFA authenticator is asking multiple times while opening each browser tab?
User's image

User's image

Microsoft 365 and Office | Install, redeem, activate | For business | Other
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ana Le 2,965 Reputation points Independent Advisor
    2026-10-23T10:22:58.1433333+00:00

    Hi,

    As the forum’s AI recommended, start by checking the affected users’ sign-in logs and security-information registration settings. Your screenshots show registration/review prompts; they do not, by themselves, confirm that users must approve a new MFA request for every tab.

    Before changing organization-wide policies, please test with one affected user:

    1. On “Review your info,” select “Looks good” if the listed information is accurate, or “Update now” if something needs correcting. Complete any remaining registration steps, then open another affected app in a new tab within the same normal browser profile.
    2. Check Entra ID > Monitoring & health > Audit logs, filtering the Service to Authentication Methods. Look for “User reviewed security information” and, if registration was required, “User registered all required security information.” Microsoft records both successful and failed review attempts, so this helps establish whether the confirmation actually completed. If the review succeeds but immediately returns in the next tab, record the timestamps and compare the corresponding sign-in events.

    A couple of clarifications about the AI answer:

    • Multiple Authenticator entries do not establish that the registrations are obsolete or causing the issue. Only remove entries the user confirms are no longer needed.
    • Persistent browser sessions primarily control whether sign-in survives closing and reopening the browser. A nonpersistent session alone does not explain repeated prompts when opening tabs in the same active browser session.
    • Avoid using “Require re-register MFA” as a routine troubleshooting step here. It deletes registered phone numbers, Microsoft Authenticator registrations, and software OATH tokens, and deactivates hardware OATH tokens. “Revoke sessions” separately forces reauthentication. Neither should be necessary just to confirm that security information is accurate.

    Could you confirm whether users receive an actual approval/number-matching request on their phones for each tab, or only the two screens shown? Also, does the prompt return immediately after successfully completing the review, and which browsers and applications are affected?

    If successful registration/review is recorded but the same interruption continues across multiple users, I recommend opening a Microsoft support case with those timestamps and logs so the behavior can be investigated. Please blur email addresses and other personal information in any screenshots shared here.

    References:

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-10-23T09:11:53.2233333+00:00

    The screenshots show security-information registration and review interruptions—not only repeated MFA approvals—so first identify which tenant policy triggers each screen, then correct that policy rather than resetting every user’s Authenticator.

    1. Identify the policy generating each prompt

    For an affected sign-in:

    1. Open Microsoft Entra admin center.
    2. Go to Entra ID → Monitoring & health → Sign-in logs.
    3. Select the user’s sign-in corresponding to one of the prompts.
    4. Open Authentication Details and inspect:
      • Authentication requirement
      • Authentication method
      • Session Lifetime Policies Applied
      • Whether MFA was completed previously in the session
    5. Open the Conditional Access tab and record every applied policy.

    The most restrictive session policy determines when reauthentication occurs. In particular, short Sign-in frequency settings and nonpersistent browser sessions can produce frequent prompts.^1^

    For a tenant-wide investigation, go to Diagnose & solve problems → Sign-in Diagnostic → Troubleshoot, search by user, application, and sign-in time, and review the reported MFA or Conditional Access trigger.^2^

    2. Correct the registration/review interruptions shown

    The Review your info screen is a security-information review. The Let’s keep your account secure screen is a registration interruption requiring another authentication method. These can be triggered by MFA, self-service password reset (SSPR), Identity Protection, Conditional Access, or registration-campaign policies.^3^

    Review these tenant settings:

    • Entra ID → Authentication methods → Registration campaign
      • Check whether an Authenticator or passkey campaign targets the affected users.
      • If the campaign is unintended, exclude the appropriate group or disable it.
      • If intended, have users complete registration rather than repeatedly postponing it. Registration campaigns can prompt eligible users after MFA.^4^
    • Entra ID → Password reset → Registration
      • Review whether users must register at sign-in.
      • Review the configured interval for reconfirming authentication information.
    • Entra ID → Protection → Identity Protection
      • Check for a policy requiring MFA registration.

    Because the screenshot lists several old or duplicated Authenticator registrations, the affected user should select Update now, remove obsolete device registrations, keep the current device, and set the intended default method. Registration and review results can be checked under Entra ID → Monitoring & health → Audit logs, filtering Service to Authentication Methods.^5^

    3. Correct actual MFA repetition between browser tabs

    If sign-in logs confirm that each tab is requesting MFA—not merely registration:

    1. Go to Entra ID → Conditional Access → Policies.
    2. Review policies applying to the affected users and applications.
    3. Under Session, inspect:
      • Sign-in frequency
      • Persistent browser session
    4. Remove an unintended Every time or excessively short sign-in frequency, or consolidate overlapping policies.
    5. Test the change with a small group before organization-wide rollout.
    6. Ask users to accept Stay signed in? if that option is enabled and organizational policy permits it.

    With Entra ID P1 or P2, Microsoft recommends managing reauthentication through Conditional Access Sign-in frequency and Persistent browser session. Managed or hybrid-joined devices also receive a Primary Refresh Token that supports SSO across applications.^1^

    Also verify that users are not opening applications in separate browser profiles, private windows, or isolated cookie containers. Persistent authentication is browser-cookie based, so isolated sessions cannot share it.

    4. If legacy per-user MFA is also enabled

    Only if Users → All users → Per-user MFA shows users as Enabled or Enforced, migrate MFA enforcement to Conditional Access and then disable legacy per-user MFA for those users. Microsoft recommends this configuration to reduce unnecessary MFA prompts.^6^

    Do not disable per-user MFA until the replacement Conditional Access policy has been tested and covers the required users and resources.

    5. Reset individual registration only if it remains corrupted

    If prompts continue for specific users after the tenant policies are corrected:

    1. Go to Entra ID → Users → affected user → Authentication methods.
    2. Select Revoke sessions.
    3. Select Require re-register multifactor authentication.
    4. Have the user remove obsolete work-account entries from Microsoft Authenticator and register the current account again.

    This invalidates existing sessions and requires fresh MFA registration, so it should be a per-user remediation rather than the first organization-wide action.^7^

    References

    1. Reauthentication prompts and session lifetime for Microsoft Entra multifactor authentication
    2. What is the Sign-in diagnostic in Microsoft Entra ID?
    3. Combined security information registration for Microsoft Entra overview
    4. Run a registration campaign to set up a passkey or Microsoft Authenticator
    5. Troubleshoot combined security information registration
    6. Microsoft Entra recommendation: Switch from per-user MFA to Conditional Access MFA
    7. I have authentication issue with Microsoft Authenticator (authenticator asking for authentication). - Microsoft Q&A
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.