Confused about MFA for Azure Portal

Christopher Sykes 0

I got an email about having to set up MFA for my Azure Portal, and I find it very confusing trying to do that. I have Microsoft 365, but I can't tell if that should give me a way to set up Azure Portal MFA without paying additional service charges. As it stands, it seems to want me to start a free trial of a "Premium" product (which one exactly is also confusing). I really don't understand what is going on here. Will my Azure Portal resources still work (checking in code, running release pipeline, hosting my web app)?

2 answers

Jos van Schouten 81 Reputation points

2024-08-20T21:19:58.51+00:00

Microsoft announced MFA will be mandatory in the future for signing into Azure. This will be done in two phases (Azure Portal, Entra and Intune in phase 1) but will later include sign ins for Azure CLI and Iac Tools (early 2025 according to the linked page).

Depending on your license some MFA features are either free or paid for (for instance MFA through the mobile app is available for free, text messages are not for normal users). The article and table and I linked go into the pricing and features.tl;dr Basically MFA is mandatory from October onwards. If you just configure MFA on the Microsoft Authenticator you'll be fine.
Please sign in to rate this answer.
Christopher Sykes 0 Reputation points

2024-08-21T11:07:36.5066667+00:00

I have Microsoft Authenticator on my phone, and am comfortable using it, but what is unclear is how to add that method in Azure Portal. That's because the Portal page for MFA says to set a free trial for a Premium service to enable MFA. It feels like they are forcing me to switch from free to paid, which is their prerogative. However, clicking on the button for the free trial takes me to options about Entra, which I know nothing about, and am not sure what it is or whether I need it. From your answer, are you saying I can go to Microsoft Authenticator on my phone and set it up from there?

Jos van Schouten 81 Reputation points

2024-08-21T11:23:40.93+00:00

Could you post a screenshot of what you're seeing? I've just poked around in my personal/testing tenant and can't seem to reproduce anything with a premium service around Entra ID.

You should have the app enabled in your tenant. If you go to Identity Protection > Authentication Methods > Policies: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods/fromNav/Identity

It should list the Microsoft Authenticator as an option. I have it targeted to all users.

Once this option (if it's not already available) every user should be able to register themselves for MFA. Registering for MFA is not done in the Azure Portal though. That's done on a user's profile: https://mysignins.microsoft.com/security-info

Hope this helps

Christopher Sykes 0 Reputation points

2024-08-21T12:00:19.1033333+00:00

You may be a little ahead of where I am. I don't think I have Entra. My MFA page in the Azure portal shows attached image when I click the button to get a free trial for a Premium service.

Jos van Schouten 81 Reputation points

2024-08-21T12:26:49.3233333+00:00

Ah, it looks like you're signed in with a personal account (screenshot looks like a gmail account signed in). Is this a regular tenant you're using or is it a developer tenant? Or is it connect to your MSDN / Visual Studio Enterprise account (the one with the 150 dollar free Azure credits)?

Try to go the Entra portal, entra.microsoft.com and see if you can find the steps I listed earlier. This screenshot is from the Azure portal, management of MFA for your users connecting to the Azure Portal is handled in the Entra ID portal.

Christopher Sykes 0 Reputation points

2024-08-22T12:29:57.8533333+00:00

Thanks Jon. So, I do have Entra after all. I just set up MFA for all users as in your screenshot. My Azure portal MFA page still has that message about getting Premium to enable the feature, but I am starting to think that is misleading me. Since I do not have other users, do I need anything further? In other words, will I still be able to access my Azure portal?

Jos van Schouten 81 Reputation points

2024-08-22T13:13:41.2366667+00:00

Yeah, I've never seen that what you screenshotted in a production tenant before, so that might it when you create one with a personal account.

If all your users, (but most importantly your Global Admin(s) have MFA enabled you should be set.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Navya 9,565 Reputation points Microsoft Vendor

2024-08-22T08:31:57.5166667+00:00

Hi @Christopher Sykes

Thank you for posting this in Microsoft Q&A.

I understand that you received an email to setup multifactor sign in for an azure tenant/Microsoft Entra.

Starting 15 October 2024, we will require users to use multifactor authentication (MFA) to sign into the Azure portal, Microsoft Entra admin center, and Intune admin center. To ensure your users can maintain access, you’ll need to enable MFA by 15 October 2024.

For your reference: Enable multifactor authentication for your tenant by 15 October 2024

You can enable multi factor authentication (MFA) without require premium license by using security Defaults in Microsoft Entra ID/Azure Portal, however this enforces MFA on entire tenant and enforces users to register for MFA. More details on following documentation link: https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

Also, you can use conditional access policy which required premium license this is more into customizable.

Yes, your Azure Portal resources, such as code checking, release pipelines, and web app hosting, will continue to work as usual. Enabling MFA only adds an extra layer of security to your Azure Portal account, ensuring that only authorized users can access your resources.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Please sign in to rate this answer.
Christopher Sykes 0 Reputation points

2024-08-22T12:17:19.1466667+00:00

Hello Navya. I appreciate your response. Thanks for letting me know my Azure Repos and Pipelines will still function normally. I see from following the answer from Jon that I do have Entra (I thought I didn't), and I set "MFA" to "All Users" from the Entra site. I'm hoping that is all I need to be able to continue accessing my Azure portal.

Navya 9,565 Reputation points Microsoft Vendor

2024-08-22T12:42:01.71+00:00

Hi @Christopher Sykes

Thank you for following up on this!

Please follow the below steps

In Azure Portal -> select Microsoft Entra Id -> In the left side select properties -> go to the security defaults - >Click on Manage security defaults as shown in the below image -> Select enabled from drop down and click on save option to save the security defaults. This way you can setup MFA without license

Note: Security defaults can only be configured in your tenant if no conditional access policy has been set to on.

Also, you can use https://entra.microsoft.com to log in using your Azure credentials.

Hope this helps. Do let us know if you any further queries.

Christopher Sykes 0 Reputation points

2024-08-22T13:08:53.8166667+00:00

I see that is already enabled. The Azure portal still shows as per image.

Navya 9,565 Reputation points Microsoft Vendor

2024-08-26T07:01:29.3133333+00:00

Hi @Christopher Sykes

If your tenant was created on or after October 22, 2019, security defaults might be enabled in your tenant. Have you configured or started using multi-factor authentication (MFA) previously?

Do you have Microsoft 365 license in your tenant?

EMS E3, Microsoft 365 E3, and Microsoft 365 Business Premium includes Microsoft Entra ID P1. EMS E5 or Microsoft 365 E5 includes Microsoft Entra ID P2. You can use the same Conditional Access features noted in the following sections to provide multifactor authentication to users.

Christopher Sykes 0 Reputation points

2024-08-26T11:39:07.89+00:00

Hi @Navya , thank you for staying with me on this!

I made my Azure Portal resource 4 years ago.

I didn't know I had Microsoft Entra ID Free, and I don't see anywhere where it tells me its age. I don't know if I use it behind the scenes for anything.

I have Micorsoft 365 (Family).

I don't see any connections between the three.

I use Azure DevOps for my Repos and for my one Pipeline to deploy my web app. Nobody else codes wit me. My web app does not have user login. No sensitive data exists there.

The Azure Portal will not let me set up MFA, so I have not used it to access that.

I changed Entra to "MFA for All Users" while following this thread, but it has not prompted me to use MFA when accessing the site.

I use Microsoft Authenticator for work.

Navya 9,565 Reputation points Microsoft Vendor

2024-08-27T02:39:40.32+00:00

Hi Christopher Sykes,

Can we work on this thread offline. Please send us an email on azcommunity [at] microsoft [dot] com with Sub - "ATTN: Navya" and following details in the email body: Link to this thread/post.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Confused about MFA for Azure Portal

2 answers

Your answer