Entra External ID - Activate MFA for users and still use Microsoft default security settings

Note: Since your support thread is primarily in English, I’m providing the response and references in English as well. If you prefer a different language, just let me know. 

Dear @TECHZARD,

Thank you for posting your question in the Microsoft Q&A forum.   

I understand that you would like to remain aligned with Microsoft’s standard security posture while still ensuring that MFA is triggered only when it is genuinely needed rather than during every sign‑in. 

Here is some information that can help clarify the issue: 

Why MFA is not triggering during your tests: 

• Microsoft’s default security for External ID uses adaptive risk‑based logic. This means MFA only appears when a sign‑in looks suspicious, not during normal or low‑risk sign‑ins. This helps reduce unnecessary prompts and prevents users from approving MFA automatically without thinking. 
• Using a VPN or signing in from another country does not always count as risky. The risk engine looks for specific threat signals such as Tor or anonymous IPs, impossible travel, unfamiliar or unusual sign‑in patterns, or IPs with known malicious activity. If none of these conditions are met, MFA will not appear. 
• The default session behavior can also keep users signed in for up to ninety days if no new risk is detected, so MFA may not trigger again for a while. 
• It is also important to note that Microsoft’s standard security settings do not aim to prompt MFA frequently. The design is to require MFA only when risk or policy conditions justify it.   

There are two supported paths depending on which license features you have available: 

Option 1: Use risk‑based Conditional Access with Entra ID Protection 

This is the recommended approach if you want MFA to be triggered only when risk signals justify it.  

• You will need Entra ID P2 or Entra Suite to use sign‑in risk conditions in Conditional Access. 
• Configure the authentication methods your external users can use, such as Email OTP or SMS if enabled. 
• Navigate to Entra admin center, go to Entra ID and select Authentication methods. 
• Create a Conditional Access policy that evaluates sign‑in risk and requires MFA when the risk meets your threshold. 
• Go to Entra admin center, select Conditional Access and create a new policy. 

• Under Users, target all users except break‑glass accounts. 

• Under Cloud apps, choose All resources. 
• Under Conditions, enable Sign‑in risk and set the level to Medium or above. 
• Under Grant, select Require multifactor authentication. 
• Keep the default sign‑in frequency so the system does not prompt too often and continues to follow the standard adaptive model. 

This approach keeps MFA lightweight for most users while still ensuring strong protection when sign‑ins appear suspicious. 

Option 2: Use Conditional Access without risk signals 

If you do not have access to risk‑based conditions, you can still avoid prompting MFA every time by targeting MFA only for specific scenarios. 

Require MFA only for sensitive applications or actions. 
You can use app‑specific Conditional Access policies or authentication context for step‑up MFA inside the application. 

Require MFA for certain conditions such as untrusted locations, unknown networks or devices that do not meet compliance or security requirements. 
This keeps you close to the standard security approach while preventing excessive MFA prompts. 

Additional information is available in the following resources: 
Risk-based user sign-in protection in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn 

Configure Security Defaults for Microsoft Entra ID - Microsoft Entra | Microsoft Learn 

What are risk detections? - Microsoft Entra ID Protection | Microsoft Learn 

Simulate Risk Detections in Microsoft Entra ID Protection for Enhanced Security - Microsoft Entra I… 

Risk policies - Microsoft Entra ID Protection | Microsoft Learn 

Sign-in risk-based multifactor authentication - Microsoft Entra ID | Microsoft Learn 

Add multifactor authentication (MFA) to a customer app - Microsoft Entra External ID | Microsoft Le… 

Conditional Access - Authentication strength for external users - Microsoft Entra ID | Microsoft Le… 

MFA in external tenants - Microsoft Entra External ID | Microsoft Learn 

Investigate risk with Microsoft Entra ID Protection - Microsoft Entra ID Protection | Microsoft Lea… 

• How to test that adaptive MFA works: 

To confirm that MFA triggers correctly, I recommend using methods that are known to generate risk, such as using the Tor browser to appear as an anonymous IP or signing in from a clean virtual machine and a fresh VPN endpoint so the system detects unfamiliar sign‑in characteristics.  

Risk signals may take several minutes to appear in the logs, so it is best to wait ten to 15 minutes before reviewing the results in the Sign‑in or Identity Protection reports. 

As community moderators, we kindly ask for your understanding that our access to internal development details is limited. Our primary role is to guide users toward the appropriate resources and support channels. While we may not have visibility into performing deeper backend analysis, we’ll continue doing our best to support you within the scope of our responsibilities.  

I hope this information is helpful. If you have any questions or need further support, please don’t hesitate to reach out at any time. 

Thank you for your patience and understanding. 

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have any extra questions about this answer, please click "Comment".            

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.