how to suppress mfa prompts on shared kiosk devices

TL;DR

Shared kiosks should not prompt every user for MFA. The legitimate options are excluding the kiosk accounts from the MFA requirement through Conditional Access with compensating controls, or using device-bound sign-in so the device proves itself. Never share one user's MFA-registered phone across a kiosk.

The query

how to suppress mfa prompts on shared kiosk devices

Use this when

• shared kiosk or front-desk station prompting for MFA
• lab machines used by rotating staff
• documenting the kiosk identity exception for auditors

Not for

• bypassing MFA for regular user accounts (that is a security exception, not a kiosk design)
• personal devices
• hiding the exclusion from security review

Steps

1. Inventory the kiosk accounts and devices and place them in a dedicated Conditional Access exclusion group. Expected output: a clear list of kiosk identities
2. Create a Conditional Access policy that excludes those accounts from the MFA requirement, scoped to the kiosk network location or compliant-device state. Expected output: the policy applies only to kiosks
3. Add compensating controls: minimal permissions on kiosk accounts, short session lifetimes, and sign-in risk monitoring. Expected output: the risk exception is documented and bounded
4. Consider device-bound credentials on the kiosk so the device authenticates instead of a human factor. Expected output: sign-in works without per-user prompts
5. Review the exclusion quarterly and remove stale kiosk accounts. Expected output: no orphaned exceptions accumulate

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_GV2F7xlMy9XoRDiH2N2SmQ

Resolved from the public thread: https://vectle.com/posts/pst_GV2F7xlMy9XoRDiH2N2SmQ

Thread query: how to suppress mfa prompts on shared kiosk devices

TL;DR: Shared kiosks should not prompt every user for MFA. The legitimate options are excluding the kiosk accounts from the MFA requirement through Conditional Access with compensating controls, or using device-bound sign-in so the device proves itself. Never share one user's MFA-registered phone across a kiosk.