Setup MFA for Account

Question

Hi All

i have an Azure AD account and i want to set up MFA for it. This account is a global admin account. i have logged in with this account.

Microsoft Entra ID-->users--> i have selected this account. Under Authentication methods, i see two options

Require re-register multifactor authentication & Revoke multifactor authenticaton sessions. i dont see option to setup MFA.i have a thrid party application which stores secrets. If i get the code and I can insert the code in the third party application and i control the MFA from that application. This is my requirement.

2. Is there any option in Entra id to know the password related information. i.e do we have option for password never expires.

Answer 1

Hello! Both options will always be available, but they do not necessarily signal that Multi-Factor Authentication (MFA) applies to the account. To ensure MFA enrollment, you must enforce it through one of the following methods:

1. Security Defaults: Enabling security defaults in Azure AD ensures that MFA is required for all users in your organization. It's a simple way to enhance security without complex configurations.
2. Per-User MFA: With per-user MFA policies, you can selectively enforce MFA for specific users. This approach allows more flexibility and customization.
3. Conditional Access: Use conditional access policies to define specific conditions under which MFA is required. For example, you can enforce MFA based on location, device type, or risk level.

Regarding password information, it's all stored in the passwordProfile property. This property contains details related to password management, including password change history and expiration policies.

Let me know if you need additional or more detailed guidance. If this answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution. 🌟

Answer 2

when i follow the below article i dont see the MFA settings to enable for this particular user.

https://k21academy.com/microsoft-azure/az-500/azure-ad-multi-factor-authentication/

Answer 3

Hi, be aware that Per-User MFA will be deprecated in favour of Authentication Methods.

In EntraID you will see legacy option Multifactor Authentication and new option Authentication Methods.

You will need to enable the new Authentication Methods, then go into the legacy MFA and disable the Per-User MFA. Disable service flags that map to new methods. Disable SSPR if enabled. Go to Authentication Methods and select Manage Migration and confirm "migration complete". Re-enable SSPR.

For MFA you will need to create Conditional Access policies.

I suggest to create all the common recommended CA policies https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-admin-mfa