organisation level users are getting MFA authenticator request multiple times while opening each app on different tabs?

The screenshots show security-information registration and review interruptions—not only repeated MFA approvals—so first identify which tenant policy triggers each screen, then correct that policy rather than resetting every user’s Authenticator.

1. Identify the policy generating each prompt

For an affected sign-in:

1. Open Microsoft Entra admin center.
2. Go to Entra ID → Monitoring & health → Sign-in logs.
3. Select the user’s sign-in corresponding to one of the prompts.
4. Open Authentication Details and inspect:
   • Authentication requirement
   • Authentication method
   • Session Lifetime Policies Applied
   • Whether MFA was completed previously in the session
5. Open the Conditional Access tab and record every applied policy.

The most restrictive session policy determines when reauthentication occurs. In particular, short Sign-in frequency settings and nonpersistent browser sessions can produce frequent prompts.^1^

For a tenant-wide investigation, go to Diagnose & solve problems → Sign-in Diagnostic → Troubleshoot, search by user, application, and sign-in time, and review the reported MFA or Conditional Access trigger.^2^

2. Correct the registration/review interruptions shown

The Review your info screen is a security-information review. The Let’s keep your account secure screen is a registration interruption requiring another authentication method. These can be triggered by MFA, self-service password reset (SSPR), Identity Protection, Conditional Access, or registration-campaign policies.^3^

Review these tenant settings:

• Entra ID → Authentication methods → Registration campaign
  • Check whether an Authenticator or passkey campaign targets the affected users.
  • If the campaign is unintended, exclude the appropriate group or disable it.
  • If intended, have users complete registration rather than repeatedly postponing it. Registration campaigns can prompt eligible users after MFA.^4^
• Entra ID → Password reset → Registration
  • Review whether users must register at sign-in.
  • Review the configured interval for reconfirming authentication information.
• Entra ID → Protection → Identity Protection
  • Check for a policy requiring MFA registration.

Because the screenshot lists several old or duplicated Authenticator registrations, the affected user should select Update now, remove obsolete device registrations, keep the current device, and set the intended default method. Registration and review results can be checked under Entra ID → Monitoring & health → Audit logs, filtering Service to Authentication Methods.^5^

3. Correct actual MFA repetition between browser tabs

If sign-in logs confirm that each tab is requesting MFA—not merely registration:

1. Go to Entra ID → Conditional Access → Policies.
2. Review policies applying to the affected users and applications.
3. Under Session, inspect:
   • Sign-in frequency
   • Persistent browser session
4. Remove an unintended Every time or excessively short sign-in frequency, or consolidate overlapping policies.
5. Test the change with a small group before organization-wide rollout.
6. Ask users to accept Stay signed in? if that option is enabled and organizational policy permits it.

With Entra ID P1 or P2, Microsoft recommends managing reauthentication through Conditional Access Sign-in frequency and Persistent browser session. Managed or hybrid-joined devices also receive a Primary Refresh Token that supports SSO across applications.^1^

Also verify that users are not opening applications in separate browser profiles, private windows, or isolated cookie containers. Persistent authentication is browser-cookie based, so isolated sessions cannot share it.

4. If legacy per-user MFA is also enabled

Only if Users → All users → Per-user MFA shows users as Enabled or Enforced, migrate MFA enforcement to Conditional Access and then disable legacy per-user MFA for those users. Microsoft recommends this configuration to reduce unnecessary MFA prompts.^6^

Do not disable per-user MFA until the replacement Conditional Access policy has been tested and covers the required users and resources.

5. Reset individual registration only if it remains corrupted

If prompts continue for specific users after the tenant policies are corrected:

1. Go to Entra ID → Users → affected user → Authentication methods.
2. Select Revoke sessions.
3. Select Require re-register multifactor authentication.
4. Have the user remove obsolete work-account entries from Microsoft Authenticator and register the current account again.

This invalidates existing sessions and requires fresh MFA registration, so it should be a per-user remediation rather than the first organization-wide action.^7^

References

1. Reauthentication prompts and session lifetime for Microsoft Entra multifactor authentication
2. What is the Sign-in diagnostic in Microsoft Entra ID?
3. Combined security information registration for Microsoft Entra overview
4. Run a registration campaign to set up a passkey or Microsoft Authenticator
5. Troubleshoot combined security information registration
6. Microsoft Entra recommendation: Switch from per-user MFA to Conditional Access MFA
7. I have authentication issue with Microsoft Authenticator (authenticator asking for authentication). - Microsoft Q&A