Brand new O365 requiring MFA even when disabled?

[thecomputerguy]

I have recently setup 2 brand new Office 365 accounts with a handful of Business Premium licenses to be able to use Sharepoint/Teams, both of them were nearly setup identically.

Create account, create a non-licensed admin for myself, fire up teams and build the structure.

One of these O365 accounts is requiring "More Information" across all users, even though MFA was never enabled and self-service password reset enabled is set to "None".

When you hit next, even worse is the ONLY option is Mobile App.

THIS ONLY AFFECTED ONE OF THE NEW O365 ACCOUNTS I MADE







Also, I recently created some email accounts for a client in Godaddy's version of O365 (not my choice) and those specific emails also got hit with the "More Information Required" and they were brand new email accounts on a relatively new domain with DEFAULT settings and no Sharepoint/Teams usage.

Called M$ and they are clueless, any idea whats going on here?

I don't want these users required to use MFA it's just going to create more headache for me walking them through this on their stupid iPhones.

 

[thecomputerguy]

Ok MS did eventually figure it out. Very strange that this doesn't seem to be consistent, nor is it easy to find.

https://docs.microsoft.com/en-us/az...entals/concept-fundamentals-security-defaults

 

[nlinecomputers]

Ok MS did eventually figure it out. Very strange that this doesn't seem to be consistent, nor is it easy to find.

https://docs.microsoft.com/en-us/az...entals/concept-fundamentals-security-defaults

M$ beat me too it. I’ve seen this exact problem on older office 365 accounts that had non existent security defaults. Office 365 has a lot of legacy crap and new azure level defaults that can conflict with each other. You sometimes have to disable and re-enable the defaults in order to wipe out the locally set overrides. Honestly in today’s environment you want to force MFA on everybody.

 

[Sky-Knight]

Security Defaults... And the first thing I do on every tenant is turn that off, then reverse course into the MFA configuration to kick it back on for the mailboxes that need it (IE all admin logins, and user facing mailboxes).

You'd think that'd basically be going right back to "Defaults" but the critical difference here is I gain the ability to turn off MFA when I need to.

And yes this has been a thing for over a year now.