The name of the setting doesn’t really explain it well.

Under remember multi-factor authentication on trusted device, Allow users to remember multi-factor authentication on devices they trust.

The setting we are focused on is at the bottom. If we dig into the legacy multi-factor authentication service settings portal, which can be found by browsing to Azure AD -> Security -> MFA, and then on the right, under Configure, select Additional cloud-based MFA settings. There is one setting, however, that tends to lurk deep within Azure AD tenants, especially for organizations that have had their tenant for a long while, that goes unnoticed, and when left enabled, allows users to potentially interfere with what we believe to be their authentication pattern. Occasionally there is the reminder to block legacy authentication (speaking of – have you?), but the focus tends to be on what’s new, and not reviewing what’s old. Advancements in Conditional Access, Windows Hello for Business, FIDO2 – the focus is on what’s new and where to go. When talking with organizations about securing their Azure AD tenants, there is always a focus on the latest and greatest, and all the ways it brings everyone forward on the Zero Trust journey.

Mfa active directory