Error Disabling Microsoft Managed MFA Policy due to Invalid User Ids

Mike Key 0

We are completing a migration away from per-user MFA to conditional access-enforced MFA for all users. As we now have a policy in place that enforces MFA for all users, I'd like to turn off the Microsoft-managed "Multifactor authentication for per-user multifactor authentication users" policy.

Unfortunately, when I try to disable the policy, I receive the following error:
"Object id(s) {list of object ids} are invalid user object(s). Remove invalid user id(s) from 'conditions:users' to resolve this error."

I have searched for some of the object IDs but have been unable to find them, so suspect they are accounts that have been deleted.

The policy also contains users who no longer have a per-user policy enforced, so it doesn't look like the policy is being automatically maintained or updated.

As this is a managed policy, I can't edit the user list from either the browser or PowerShell - is there any other way to disable or remove this policy?

Harshitha Eligeti 1,210 Reputation points Microsoft Vendor

2024-12-24T22:03:35.2366667+00:00

Hi @ Mike Key

Thank you for reaching out Microsoft Q&A.

I understand that you're encountering an issue while migrating from per-user MFA to Conditional Access-enforced MFA for all users. When attempting to disable the policy, you're seeing the following error:

"Object id(s) {list of object ids} are invalid user object(s). Remove invalid user id(s) from 'conditions: users' to resolve this error."

This error is likely caused by the policy including user object IDs that have been deleted. Since this is a Microsoft-managed policy, you can't rename or delete any Microsoft-managed policies. However, an admin, you do have the ability to modify the policy's state (On, Off, or Report-only) and manage the excluded identities (Users, Groups, and Roles) within the policy.
As mentioned in the screenshot below. Can you try to turn off the policy using edit option under excluded identities section.

For additional information refer this link: Secure your resources with Microsoft-managed Conditional Access policies - Microsoft Entra ID | Microsoft Learn

Hope this helps. Do let us know if you have any further queries.
Regards,
Harshitha Eligeti

Share via

Error Disabling Microsoft Managed MFA Policy due to Invalid User Ids

Your answer