I am the Global Admin for an Azure tenant on the free tier (tied to a Microsoft 365 E1 nonprofit account). Following the automatic rollout of Security Defaults, I have one user who did not set up a MFA method in time, and is now being prompted to enter codes he does not have.

I can see in the audit logs that Entra accepts his username & password, then issues an MFA challenge because it believes he is “risky”. Sadly this is doomed to fail because he does not have our tenant registered in his Authenticator phone app.

The simplest solution should be to re-register or revoke his faulty MFA, but trying either of those leads to a popup error.

Relatedly (?), Entra claims that I don’t have permission to manage auth methods.

Manually granting myself RBAC via roles such as “Privileged Authentication Administrator” did not help. I still get the popup & lack of permission seen above.

My roles:

The roles & properties of the user who cannot login:

Turning off Security Defaults did not help.

Resetting the user’s password did not help.

Toggling the user’s MFA Status from Disabled->Enabled->Disabled on the “Per-User MFA” page did not help.

Trying these 3 actions on the “Per-User MFA” page did not help. (the first gives an error; the second & third succeed but do not change the situation)

How do I get us out of this catch-22? Why is Global Admin not sufficient?