Question

Contoso has 4,200 users who were enabled for MFA years ago using legacy per-user MFA (their state is set to 'Enforced' in the MFA service settings). Security wants to modernize to Conditional Access so they can require MFA based on risk and location, and eventually retire per-user MFA. During the transition, an administrator creates a Conditional Access policy requiring MFA for all users. Several users report they are still being prompted to re-register MFA methods and are asked to confirm the app-password legacy behavior. What is the recommended approach to complete the migration cleanly?

Accepted Answer

Use the Microsoft Entra 'per-user MFA to Conditional Access' migration utility to convert users' per-user MFA state to Disabled after confirming the Conditional Access policy enforces MFA, so methods and registrations are preserved.

Answer

Delete all users' registered authentication methods first, then set per-user MFA state to Disabled and let users re-register through the Conditional Access prompt.

Answer

Leave per-user MFA state at 'Enforced' and rely on the Conditional Access policy, since both layers enforce MFA and this provides defense in depth.

Answer

Convert all users to per-user MFA state 'Enabled' instead of 'Enforced', which disables legacy behavior while keeping Conditional Access as the primary control.