MFA can't be ignored.

If users still get MFA after disabling legacy MFA and migrating authentication methods, MFA is still being enforced somewhere else. In this scenario, check these layers in order:

1. Conditional Access exclusions
   • In Microsoft Entra admin center, go to Protection > Conditional Access.
   • Open each policy that requires MFA.
   • Under Users or Assignments > Users, add the affected user or an exclusion group to Exclude.
   • Save the policy.
   • If testing a new MFA policy while an old policy still exists, exclude the test users from the old policy so they are not hit by both policies.
2. Verify policy evaluation with What If
   • Go to Protection > Conditional Access > What If.
   • Select the affected user and target app.
   • Run What If.
   • Confirm the old policy does not apply and the intended policy behavior does apply.
   • If users are seeing both prompts, that usually means they were not excluded from the old policy.
3. Per-user MFA
   • If any users are still marked as enabled in the old per-user MFA portal, that can still force MFA unexpectedly and cause inconsistent sign-in behavior.
   • The recommended action is to disable per-user MFA for remaining users so MFA is controlled only by Conditional Access.
4. Emergency or excluded accounts
   • Only emergency access accounts should normally be excluded from MFA requirements.
   • Microsoft recommends at least two emergency access admin accounts, and those accounts should be excluded from MFA-related Conditional Access policies.
5. If the sign-in is to an admin portal
   • Mandatory MFA enforcement applies to admin portal logins.
   • This enforcement is not configurable and is separate from tenant access policies.
   • In that case, exclusions in Conditional Access, disabled security defaults, disabled registration campaign, and disabled per-user MFA do not prevent the MFA registration or challenge for admin portal sign-in.
6. If using Microsoft-managed policies
   • Some Microsoft-managed Conditional Access policies can be edited through the Excluded identities section.
   • If editing with the top Edit pencil causes failed to update, use Edit under Excluded identities instead.

A practical troubleshooting path:

1. Check whether the affected user is signing in to an admin portal.
2. Review all MFA-related Conditional Access policies and add the user to Exclude where appropriate.
3. Check for any remaining per-user MFA enabled users and disable that legacy setting.
4. Run What If to confirm exactly which policy is applying.
5. If the user is still prompted only on admin portal sign-in, that is due to mandatory admin MFA enforcement, not a tenant policy misconfiguration.

References:

• Migrate from custom controls to external multifactor authentication
• Set up multifactor authentication for Microsoft 365
• Microsoft-managed Conditional Access policies
• How to disable MFA for testing - Microsoft Q&A
• how to turn off MFA for a specific user - Microsoft Q&A
• What to do with the users listed under Per-user multifactor authentication? - Microsoft Q&A