What you’re seeing
- A sign-in prompt saying "Action required — your organization requires additional security information".
- A countdown note that the user has 14 days before Authenticator setup becomes mandatory.
- Per-user MFA shows Disabled in the admin center, yet staff keep getting approval prompts.
- New accounts are asked to install Microsoft Authenticator on their very first sign-in.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- Security defaults are switched on for the tenant, which requires every user to register Authenticator regardless of per-user MFA settings.
- Microsoft enabled security defaults automatically on a newer tenant or one with no Conditional Access policies.
- A Conditional Access policy or Microsoft-managed policy requires MFA for some or all users.
- Authentication method policies push users toward registering Authenticator during sign-in campaigns.
Why it matters
These prompts confuse staff who were told MFA was off, and they generate support calls, delayed sign-ins and people stuck without access while they find their phones. The bigger risk is the reaction: switching off the baseline protection removes one of the most effective defenses against stolen passwords. For a small business, a single compromised mailbox can lead to invoice fraud, so the aim should be a smooth MFA rollout rather than removing it.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
MFA is off for our users. Why are they being asked?
Per-user MFA is only one of several places MFA can be required. Security defaults and Conditional Access policies apply independently and override that setting.
Should we disable it?
We don't recommend it. MFA blocks the vast majority of account takeover attempts, and there are friendlier options than switching it off.
Can you help us roll it out without disruption?
Yes. A certified US engineer can plan the right approach with you over a remote secure session, from $99, and you pay only when it's resolved.