Recently was troubleshooting the issue when no email is sent to the new MFA server users regardless all the configurations seems to be correct. See following official documentation for more details.
Because Administrator was able to send the Update email to the end user, we excluded the improper SMTP server configuration.
Per MFA server Help file: New Users – An email is sent to a user added that is enabled and complete (phone specified, mobile app activated, or OATH token secret key specified), or to an updated user that was either disabled or incomplete and is now enabled and complete.
Note: Emails are only sent when Send email to users is checked and the user’s email address is specified or their username is in email address format.
Confirmed that the New user has “Send email” check box selected on the User profile General Tab and the email address is correct.
Also, by going to MFA UI – Email – Email Context confirmed all the New User templates have correct email address specified in the From field.
Checked the SMTP server logs and don’t see any email send attempt from MFA server for New User email, only connections for Update email to be send.
Time to check the MFA Server logs!
To make sure you are looking at the latest logs, go to MFA UI – Logging – View Log Files.
Looking at the MultiFactorAuthAdSyncSvc.log see following error correlating to the time when the new user was added:
2018-03-07T18:20:20.006280Z|e|2960|4036|pfadssvc|***** ERROR ***** Error sending email to NewUser@domain.com: Access to the path ‘\\FileShare\public\MFA-Instructions\MFA-Guide.pdf’ is denied.
So the Administrator used the Attachment option to send additional instructions to new users, but the File share had access restrictions preventing the MFA server Local System account reading this document.
Solution was to either move the MFA instructions files to the MFA server or adjust the file share access permissions to allow Everyone to read the files.
Morale of the story: Read the manuals and logs, those are written by smart people 😊