AADSTS50079 — the user is required to use multi-factor authentication but has not yet registered any authentication methods. Unlike AADSTS50076 (MFA required and available, just not satisfied), 50079 means there is nothing to challenge: enrolment has to happen first.
AADSTS50079
User must enrol for multi-factor authentication
What it means
Common causes
MFA requirement (Conditional Access, security defaults, or per-user MFA) applies to a user who never completed security-info registration.
The user's registered methods were removed (device lost, methods reset by an admin) and re-registration is pending.
The sign-in comes from a client or flow that cannot render the registration experience.
How to fix it
Send the user to aka.ms/mfasetup (My Security Info) from a browser to register methods; the wizard runs automatically on next interactive browser sign-in in most flows.
Check and reset methods as admin: Entra admin center > Users > (user) > Authentication methods — 'Require re-register multifactor authentication' forces fresh enrolment.
Roll out registration campaigns (Entra admin center > Protection > Authentication methods > Registration campaign) before enforcing MFA broadly, so users never hit this mid-task.