Service desk excluded from MFA but registration campaign still interrupts

Scenario

Help desk staff are exempt from some MFA policies, but a registration campaign or security prompt still blocks onboarding work.

Separate Conditional Access exclusions from registration campaign settings in Entra.
Review which prompt the user is actually seeing before changing more policy.
Test the exemption with a clean browser and a newly created pilot account.
Document the support workflow so emergency access paths are not guesswork.

Document what changed, what confirmed the fix, and whether the issue points to a broader standards gap worth addressing for the client.

Subjects