The Problem: Conflicting MFA Configurations

When your organization has both per-user Multi-Factor Authentication (MFA) and Conditional Access (CA) policies enabled simultaneously, per-user MFA takes precedence. This creates a cascading problem: users face excessive MFA prompts, support tickets increase, and your security posture becomes difficult to audit and control centrally.

In one organization with ~200 users on per-user MFA and ~400 users on CA policies, this conflict was creating unnecessary friction and made it difficult to implement granular access controls based on risk and resource sensitivity.

Why Conditional Access is Superior

Conditional Access policies offer:

  • Granular Control: Apply MFA requirements only to sensitive resources or high-risk scenarios
  • Reduced Friction: Users access low-risk applications without repeated authentication challenges
  • Centralized Management: Audit and modify policies from a single plane rather than managing individual user settings
  • Risk-Based Decisions: Integrate with Azure’s risk detection to adapt requirements dynamically

Migration Strategy via A Three-Step Approach

Step 1: Audit Your Existing Conditional Access Policies

Before disabling per-user MFA, verify your CA policies are comprehensive:

# List all Conditional Access policies in your tenant
Get-AzureADMSConditionalAccessPolicy | Select-Object -Property DisplayName, State, Conditions, GrantControls

Ensure you have policies covering:

  • All cloud applications or specific high-value ones (Exchange Online, SharePoint, sensitive line-of-business apps). Ensure you have a good baseline policy.
  • User groups you want to protect (all users, admin accounts, high-risk groups)
  • MFA grant controls are configured

Step 2: Create or Refine Your Conditional Access Policies

Navigate to Azure AD → Security → Conditional Access → New policy. Here’s a recommended baseline:

Policy Name: "Require MFA for Exchange Online and SharePoint"
Assignments:
  Users and groups: All users (or specific groups)
  Cloud apps or actions: Exchange Online, SharePoint Online
  Conditions:
    Sign-in risk: Medium or High (optional)
    Device platforms: All platforms
Grant Controls:
  Grant access: Yes
  Require MFA: Yes
Session Controls:
  Sign-in frequency: 1 hour
  Persistent browser session: Disabled

For sensitive resources, create stricter policies:

Policy Name: "Require MFA for Admin Activities"
Assignments:
  Users and groups: Directory Administrators
  Cloud apps or actions: Microsoft Admin Portals, Azure Portal
Grant Controls:
  Require MFA: Yes
  Require compliant device: Yes

Step 3: Disable Per-User MFA

Once you’ve verified CA policies are in place, disable per-user MFA:

# PowerShell approach
$users = Get-MsolUser -All
foreach ($user in $users) {
    if ($user.StrongAuthenticationRequirements) {
        Set-MsolUser -UserPrincipalName $user.UserPrincipalName -StrongAuthenticationRequirements @()
        Write-Host "Disabled per-user MFA for $($user.UserPrincipalName)"
    }
}

Alternatively, use the legacy Azure AD portal: Users → Multi-Factor Authentication → Bulk update → Disable

Validation and Testing

After disabling per-user MFA:

  1. Test with pilot users: Have a group of users test sign-in to protected resources
  2. Verify MFA still fires: Confirm that Conditional Access policies are enforcing MFA where expected
  3. Monitor Azure AD sign-in logs
  4. Check for missed scenarios: If users report unexpected access patterns, audit the sign-in risk assessment and CA policy coverage

Additional Considerations

  • Legacy Clients: Some older clients (Classic Outlook on macOS, some mobile apps) may not support Conditional Access enforcement. Test these scenarios and plan workarounds (e.g., app passwords, legacy authentication blocks with exceptions). I’d personally recommend killing support for legacy authentication entirely in your tenant.
  • Guest User Scenarios: Ensure CA policies account for B2B guest access if applicable
  • Gradual Rollout: Consider disabling per-user MFA in batches (by department or location) rather than all at once
  • Documentation: Document which policies protect which resources so future admins understand your security posture

Conclusion

Migrating from per-user MFA to Conditional Access reduces authentication friction, centralizes security policy, and enables risk-based access control. The three-step approach—audit, create/refine, disable—ensures you maintain security while improving user experience. Start with pilot groups and monitor sign-in logs to catch gaps before full rollout.