Home / server / Questions / 1065790
Accepted
Daniel
Asked: 2021-06-06 03:08:57 +0800 CST

How Can I Deactivate The 'More Information Required' Screen After Sign-In?

  • 772

I need to deactivate the 'More Information Required' screen for my break-glass administrator account.

enter image description here

As per documentation I did disable the Azure Security Defaults last week.

enter image description here

Then I created one Conditional Access Policy that requires all users to sign in with MFA, except the break-glass administrator account.

This did not disabled the 'More Information Required', but at least now I am able to click on the Next button and then to skip the setup of MFA.

enter image description here

However, I need this screen to not appear in the first place. How do I achieve that?

azure-active-directory

1 Answers

  1. Best Answer

    For break glass accounts, the general recommendation is to have MFA for them that is different from what everyone else is using, and not to disable it completely: https://docs.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access

    There are several reasons why you may get prompted to register your security info: https://docs.microsoft.com/en-us/azure/active-directory/authentication/multi-factor-authentication-faq#why-are-my-users-being-prompted-to-register-their-security-information-

    And by default, accounts with Global Administrator role must have their MFA registered (read Azure AD Free): https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing#available-versions-of-azure-ad-multi-factor-authentication

    My guess that you have SSPR enabled, or the break glass account is a GA in the tenant.

    SSPR: https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr

    However, I need this screen to not appear in the first place. How do I achieve that?

    The correct answer would be to actually register MFA if you want to follow the best practices.

    • 2