About the recent Microsoft advisory

Nibha Kumari 0

Action required: Enable multifactor authentication for your tenant by 15 October 2024

Regarding the above advisory, how can I enable MFA or check whether it's implemented on users or not? I don't have any advance licence for Microsoft Entra ID or Azure portal. I can't make changes from there. I did enforce MFA on a few users through the Microsoft admin centre individual I just don't know if that is what Microsoft want.

1 answer

Marilee Turscak-MSFT 36,861 Reputation points Microsoft Employee

2024-08-21T23:59:53.07+00:00

Hi @Nibha Kumari ,

If you're using the free version of Azure, your option is to enable security defaults to enforce the MFA.

Otherwise your option is to use conditional access:

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication#prepare-for-multifactor-authentication

If you cannot enable the MFA, you can apply to postpone the enablement date.

If the information helped you, please Accept the answer. This will help us and improve searchability for others in the community who may be researching similar questions.
Please sign in to rate this answer.
Nibha Kumari 0 Reputation points

2024-08-22T06:15:24.1966667+00:00

Yes, I am using the free version of Azure. And I also have security defaults enabled.

But I haven't enforced the MFA on every user. Do I need to enforce MFA on every user?

Marilee Turscak-MSFT 36,861 Reputation points Microsoft Employee

2024-08-22T21:41:44.6633333+00:00

If you have enabled security defaults, you should turn off per-user MFA under Users > Active users > multifactor authentication > set to "Disabled."https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide#turn-off-per-user-mfa

It's not recommended to have users set to "Enabled" or "Enforced" unless you don't have either security defaults or Conditional Access.

Nibha Kumari 0 Reputation points

2024-08-23T09:42:58.9033333+00:00

Okay...After doing this, the new advisory of Microsoft to enable Multifactor authentication won't affect any of our Microsoft services, right?

And what will happen if I don't disable this individual user MFA?

Marilee Turscak-MSFT 36,861 Reputation points Microsoft Employee

2024-08-26T21:30:48.46+00:00

Hi @Nibha Kumari ,

You'll have met the requirements of the advisory if you've already enabled security defaults.

Per-user MFA is being deprecated. You can still use it along with security defaults to enforce MFA on non-admin roles, but it's better to use either Conditional Access or security defaults so that the MFA prompts are intuitive.

Azure MFA using security defaults knows when to prompt and when not to. It's intended to be intuitive and to avoid MFA fatigue. There are specific times it will prompt due to various factors (risk, etc), but it will not prompt if it is not necessary.

Note also that Security Defaults is not reflected in Per User MFA settings. Even though it says MFA is Disabled, it is not actually disabled and is enforced via Security Defaults. After users complete registration, they'll be prompted for another authentication whenever necessary. Microsoft decides when a user is prompted for multifactor authentication, based on factors such as location, device, role and task.

If you still want to enforce per-user MFA every time for non-admin roles, you can use the per-user settings along with security defaults. But it's recommended to switch to Conditional Access or use security defaults, rather than relying on the legacy/per-user MFA methods that are being deprecated.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

About the recent Microsoft advisory

1 answer

Your answer