![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Microsoft Security | Microsoft Entra | Microsoft Entra Private Access
Providing secure, identity-based access to private apps and resources without traditional VPNs
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 74%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
Hello @Shala Senadheera,
It is possible that the MFA was not asked during activation because the MFA requirement is already satisfied. It could happen if the user has just performed MFA sometime back for any other resource or for Entra portal login. So if you already have a Conditional access policy enforcing MFA globally in your tenant or for admin portal logins user may not be promted to perform MFA again while activating the role.
To confirm if you've configured MFA for role activation correctly or not, you can check the settings for the role in PIM, please refer the screenshot.
Now to check if MFA was a requirement or not during the role activation, you can view the audit log of the user who was activating the role look for PIM service and check the details. Like in the below screenshot you can see the field IsAuthenticatedWithMfa to be "YES" which means MFA was a requirement, but the user was not prompted to complete MFA as it was already previously satisfied.