Microsoft 365 - MFA for New Starters and Resets

Admin procedure. This article is for authorized administrators only. End users cannot perform these steps.

Quick answer

Add the user to the Intune_User_ConditionalAccess_SecurityRegistrationExclusion group, let them register for MFA and SSPR, then remove them from the group.

Steps

1. Sign in to the Microsoft 365 admin center with your admin account.
2. Left column drop down "Users" select "active Users".
3. Top right in search box type users name.
4. Click on the users name.
5. Click on Manage Groups.
6. Click on Assign Memberships.
7. search for the group "Intune"
8. Add the user to Intune_User_ConditionalAccess_SecurityRegistrationExclusion.
9. Allow up to 20 minutes for the change to take effect.
10. Have the user sign in and complete MFA and SSPR registration.
11. Remove the user from the exclusion group as soon as registration is complete.

Important

• A user left in the exclusion group keeps Microsoft 365 browser access without MFA. Always remove them promptly.