Why Entra User are not MFA authenticated even we are all using MFA in O365

Question

Why Entra User are not MFA authenticated even we are all using MFA in O365

Benoit Delacrose 0

Hello

We have activated MFA for all our users for many years now in O365, but in Entra, there is no MFA activated for any user. Can you explain :

why the migration to Entra didn't take in account the already activated MFA,
why we would or should activate MFA in Entra, for what purpose exactly and how much it is needed above the O365 MFA
I don't find clear information of the Entra functionnalities and purpose, and to which extent I must take care of it as I don't see which usage is based on Entra vs O365 authentication.

Best regards

Moved from Microsoft 365 and Office | Other

1 answer

Your answer

Answer 1

Aron 7,000 Independent Advisor

Hi, I understand how this can be confusing when you’ve had MFA enabled for years and now it looks different in Entra. The root cause is that the MFA you set up in the Microsoft 365 admin center uses legacy per-user settings, which only apply to Office 365 apps. Entra ID (formerly Azure AD) is the actual identity platform behind Microsoft 365, and its MFA reporting only reflects policies configured through Conditional Access or Authentication Strengths. That’s why it shows “no MFA” even though users are challenged when signing in to O365. The best next step is to check if you’re still using legacy MFA and start planning to move to Conditional Access in Entra for consistent enforcement across all apps, not just O365. Could you confirm if you see MFA settings under Active users then click multi-factor authentication in the Microsoft 365 admin center, or if you already have any Conditional Access policies in Entra? This will help us figure out the right migration path.Regards,
Aron

Benoit Delacrose 0 Reputation points

2025-12-03T14:24:06.56+00:00

Hello Aron

thanks for your advices, the fact is there is history here as O365 forced by their "standard default security" setting to force MFA some years ago, so we are all using it already.

Now that Entra is having multiple views and in fact as long I undertsood what the support said, what you get access when clicking on Multifactor authentication in Entra is "per user" and according to support, its to be used if only you didn't made a global requirement for all, and let you do it a on per-user basis. Very very confusing.

the next thing is I can't get a simple view of user using activated MFA or not, as you have to go to each user account in O365, click on it and check its mfa devices, and there is no way to have a report. Imagine if you have hundreds of users to check.

finally these tools are confusing, text describing them are multi faced, and many things are 'under the cover". As an example the fact MFA is required in O365 is not displayed explicitely, it just tells you you have activated the "default security standard", and you have to look in the docs to understand that MFA is in this standard...... How a security department can get proof of auditing and activated policies if they are not displayed but implied by another meaningless setting.

Don't waste your time on my subject anymore, thank you.
Aron 7,000 Reputation points Independent Advisor

2025-12-03T14:25:51.3066667+00:00

I hear you, and you’re absolutely right, this whole setup can feel unnecessarily complex.

The default security settings in Microsoft 365 do enforce MFA, but they don’t make it obvious, and Entra’s “per-user MFA” page adds to the confusion because it’s really meant for legacy scenarios, not for organizations using global enforcement.

The lack of a simple, centralized report is a common pain point; out of the box, there’s no quick way to see MFA status for hundreds of users without digging into each account.

Most security teams end up using Entra sign-in logs or exporting data via PowerShell to prove MFA compliance.

Share via

Why Entra User are not MFA authenticated even we are all using MFA in O365

1 answer

Your answer