Microsoft 365 & Entra ID

Disable Legacy Per-User MFA

Clears legacy per-user MFA state for all member users, for example before migrating enforcement to Conditional Access. Note: uses the legacy MSOnline module, which Microsoft is retiring.

Download .ps122 lines · PowerShell

Replace generic placeholder values (tenant, domain, secrets) for your own environment before running. Read it first and test safely.

# Connect to Microsoft Online Service (Azure AD)
Connect-MsolService

# Get all user accounts (excluding guest accounts)
$Users = Get-MsolUser -All | Where-Object {
    $_.UserType -eq 'Member' -and $_.UserPrincipalName -notlike '*#EXT#*'
}

# Check if there are valid users to disable MFA
if ($Users.Count -gt 0) {
    # Loop through each user and disable MFA
    foreach ($user in $Users) {
        # Clear StrongAuthenticationRequirements to disable MFA
        Set-MsolUser -UserPrincipalName $user.UserPrincipalName -StrongAuthenticationRequirements @()
        Write-Host -ForegroundColor Green "$($user.UserPrincipalName) MFA has been disabled."
    }

    Write-Host -ForegroundColor Green "MFA has been disabled for all valid users!"
} else {
    Write-Host -ForegroundColor Yellow "No valid users were found to disable MFA."
}