Avoid switching to Enforced after enrolling

Miguel Angel 21

Hello

We are starting to use MFA in our company, but we do not want to use Enforced method, only the Enabled. I understand that after the registration users switch to Enforced, but how can i avoid that? Even if i register the phone for them before their first time login it will do the registration and it switch to enforced.

Please provide a little guidance.

2 answers

Manoj Reddy 406 Reputation points Microsoft Employee

2020-01-09T06:31:17.01+00:00

Hi,

I am afraid it's not feasible to get MFA to work in just enabled mode. However, We recommend using Conditional Access policies to trigger MFA.

With CA policies, you can control in which scenario, the user should be prompted for MFA and users will be prompted accordingly. I would recommend going through this doc to understand more about CA policy and how to create them.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Miguel Angel 21 Reputation points

2020-01-09T18:36:02.853+00:00

I guess then i did the incorrect question, is the Enforced Method the one that is forcing the apps to have a custom password? Because that is what we do not want to use in particular, we want to keep using the Domain password of the user account
Please sign in to rate this answer.
Lukas Beran 176 Reputation points

2020-01-11T09:01:45.337+00:00

Hi Miguel.

That is something different. Basically enabled and enforced are the same options - the only difference is the very next authentication behavior - in enabled state, user is requested to add/validate authentication information during the very next web browser authentication. After that, user is always required to use MFA during authentication, which is the behavior of enforced mode.

So the enforced means that user is always prompted for MFA during authentication. It means that all apps must use modern authentication, which is the way how users authenticate in a web browser or Office apps (not just a dialog for username and password, but rendered HTML authentication dialog that supports the "modern authentication" which is required to be able to pass MFA).

So if you use apps that don't support modern authentication, you have to use app passwords anyway. If you have only apps that support modern authentication, you don't need to worry about the enforced state.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Avoid switching to Enforced after enrolling

2 answers

Your answer