Error Disabling Microsoft Managed MFA Policy due to Invalid User Ids

Mike Key 20

We are completing a migration away from per-user MFA to conditional access-enforced MFA for all users. As we now have a policy in place that enforces MFA for all users, I'd like to turn off the Microsoft-managed "Multifactor authentication for per-user multifactor authentication users" policy.

Unfortunately, when I try to disable the policy, I receive the following error:
"Object id(s) {list of object ids} are invalid user object(s). Remove invalid user id(s) from 'conditions:users' to resolve this error."

I have searched for some of the object IDs but have been unable to find them, so suspect they are accounts that have been deleted.

The policy also contains users who no longer have a per-user policy enforced, so it doesn't look like the policy is being automatically maintained or updated.

As this is a managed policy, I can't edit the user list from either the browser or PowerShell - is there any other way to disable or remove this policy?

Harshitha Eligeti 1,210 Reputation points Microsoft Vendor

2024-12-24T22:03:35.2366667+00:00

Hi @ Mike Key

Thank you for reaching out Microsoft Q&A.

I understand that you're encountering an issue while migrating from per-user MFA to Conditional Access-enforced MFA for all users. When attempting to disable the policy, you're seeing the following error:

"Object id(s) {list of object ids} are invalid user object(s). Remove invalid user id(s) from 'conditions: users' to resolve this error."

This error is likely caused by the policy including user object IDs that have been deleted. Since this is a Microsoft-managed policy, you can't rename or delete any Microsoft-managed policies. However, an admin, you do have the ability to modify the policy's state (On, Off, or Report-only) and manage the excluded identities (Users, Groups, and Roles) within the policy.
As mentioned in the screenshot below. Can you try to turn off the policy using edit option under excluded identities section.

For additional information refer this link: Secure your resources with Microsoft-managed Conditional Access policies - Microsoft Entra ID | Microsoft Learn

Hope this helps. Do let us know if you have any further queries.
Regards,
Harshitha Eligeti
Edward Walerius 0 Reputation points

2024-12-27T17:51:54.9133333+00:00

We have the exact same problem with a tenant I'm managing. I was told directly by azure support there is no way to modify the included users list and that there was nothing they could do about it.

And directly addressing the answer given: you are right we can modify these to be on, off, or report only. HOWEVER: the error with the invalid object ids in the user list is preventing us from doing so.

If as Azure support claims, there is no way to now turn these policies off, this is an absolutely unacceptable answer and needs to be fixed.
Harshitha Eligeti 1,210 Reputation points Microsoft Vendor

2024-12-31T17:15:16.8+00:00

Hello @Edward Walerius
I Understand that you were told directly by azure support there is no way to modify the included users list. Administrators have the ability to Edit the State (On, Off, or Report-only) and the Excluded identities (Users, Groups, and Roles) in the policy.
These Microsoft-managed policies allow administrators to make simple modifications like excluding users or turning them from report-only mode to on or off. Organizations can't rename or delete any Microsoft-managed policies. As Administrators get more comfortable with Conditional Access policy, they might choose to duplicate the policy to make custom versions.

Best Regards,
Harshitha Eligeti.
Edward Walerius 0 Reputation points

2024-12-31T17:18:39.9366667+00:00

You are right we absolutely can edit those things. The problem is we can't save changes to the Microsoft managed policy even for the things we SHOULD be able to change because of the error with the included users. This effectively locks it into a permanently ON state with absolutely no way to change it.
Max Krabbenhöft 0 Reputation points

2025-01-01T15:50:17.2566667+00:00

We have the exact same problem. A user that was deleted ages ago still somehow is linked to the policy and therefore it cant be disabled. This needs to be fixed as soon as possible.
Harshitha Eligeti 1,210 Reputation points Microsoft Vendor

2025-01-02T17:24:25.8533333+00:00

Hi @Mike Key
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Harshitha Eligeti 1,210 Reputation points Microsoft Vendor

2025-01-03T19:59:43.8766667+00:00

Hi @Mike Key
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Gijs Van Laer 0 Reputation points

2025-01-06T08:15:24.0333333+00:00

We have the same issue. Unfortunately, disabling the per-user MFA for specific users doesn't help, they continue to be part of the MS managed policy. We suspect that in the back end the same error occurs when it tries and propagates the change for specific users to the policy.

Moreover, this policy interferes with External Authentication Methods (as authentication strengths doesn't let EAM options show up for the user), so we need a solution asap.
Barry Boone 0 Reputation points

2025-01-06T20:05:28.2133333+00:00

Same issue here. Can't edit the policy to disable it after having made a duplicate due to the presence of deleted users in the Microsoft Managed policy.
Josh Weigner 1 Reputation point

2025-01-06T20:56:30.7266667+00:00

Same issue here, causing us major headaches.
Gijs Van Laer 0 Reputation points

2025-01-07T08:45:03.3766667+00:00

We got a response from our Microsoft support person:

Just an update from the engineering ticket this morning, the fix has been checked in. It may take up to two weeks during the roll out to mitigate the issue.
Mike Key 20 Reputation points

2025-01-08T11:38:31.9566667+00:00

Hi @Harshitha Eligeti ,

Just got back from annual leave and updating the policy as you suggested (by selecting "Edit" under the "Excluded Identities" section) gives the same result.

I note there's now an answer implying that a fix is on the way - do you know if this fix will apply to all tenants?

Many thanks,

Mike
Gijs Van Laer 0 Reputation points

2025-01-09T10:42:50.4766667+00:00

That is what they told us, that the fix is rolling out to all tenants (hence the 2 weeks potential wait). We haven't seen it fixed in our tenant yet, but I can update here if that happens.

1 answer

Harshitha Eligeti 1,210 Reputation points Microsoft Vendor

2025-01-08T14:15:43.17+00:00

Hi @Mike Key •
I have checked with my internal team regarding this issue, and it has been observed across multiple tenants. The issue has been resolved, and the changes will be rolled out across all tenants within two weeks.

Best Regards,
Harshitha Eligeti.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Error Disabling Microsoft Managed MFA Policy due to Invalid User Ids

1 answer

Your answer