Problem statement
When a user tries to log in to our application, the e-mail MFA flow is triggered. Our security settings have e-mail MFA turned off, so the user should not be prompted with the e-mail MFA flow.
Symptoms
Email MFA is disabled but some of our users are still prompted to complete an Email challenge after signing in
Steps to reproduce
- Turn off Email MFA as a factor from your Multi-Factor Authentication tenant settings
- Enable Adaptive MFA as your tenant wide policy
- If a user without an MFA enrollment triggers Adaptive MFA, they will be prompted to complete the Email MFA challenge
Cause
When Adaptive MFA is triggered for users without an MFA factor enrolled, they will be prompted to complete an Email challenge before being asked to enroll in an MFA factor. This is outlined in our Adaptive MFA documentation, which includes a handy flow diagram:
Solution
This behavior is expected when Adaptive MFA is triggered for a user without an existing MFA enrollment.