MFA REQUIRED NOTICED

Question

MFA REQUIRED NOTICED

Thiago Mouro de Souza 25

We have an important question, we recently integrated our Identity Provider Okta with Office 365 Admin, for this we need an administrator service account within Office 365 Admin "WITHOUT MFA".

We received the October 2024 change alert from Entra, Azure Ad, and Intune Admin.

Question:

Will this also affect the Office 365 admin portal for service accounts without MFA for integration/automations?

From what I saw, no, but I need confirmation because if so, what will the contour be like? It would break the integration of SAML with Office 365 and consequently with Entra, which is linked to the Office groups that come from the IDP.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Cesar Lopez 225

Hi,

Service accounts and service principals, such as the Microsoft Entra Connect Sync Account. Service accounts are non-interactive accounts that aren't tied to any particular user. They're normally used by back-end services allowing programmatic access to applications, but are also used to sign in to systems for administrative purposes. Service accounts like these should be excluded since MFA can't be completed programmatically. Calls made by service principals won't be blocked by Conditional Access policies scoped to users. Use Conditional Access for workload identities to define policies targeting service principals.

In summary, MFA not affect service account.

I send you the link about this info:

https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-all-users-mfa

Please, if the answer is validate for you, click in correct answer

Ziad ALSAMAD 46 Reputation points

2024-09-11T08:32:43.1233333+00:00

OP is referring to the Oct 15 MFA change alert which clearly states that all user accounts (including service accounts) with admin access will be forced to use MFA. Blog post

I also need an answer on this issue, especially for the service account used by Entra Connect Sync, since there is no clear method of replacing this account with a service principal or a managed identity.
Cesar Lopez 225 Reputation points

2024-09-11T08:41:45.0233333+00:00

It is the same answer about this problem @Ziad ALSAMAD

The service account is not affected for MFA. Only user accounts if the conditional access is not configurated with other option.
Thiago Mouro de Souza 25 Reputation points

2024-09-11T14:02:23.8333333+00:00

Then, I don't care about my admin service account by "Office 365 portal", right? Because this a service account, I don't have mfa now, I never have a mfa in this account, like I use in integration with Okta IDP.

I think then, I don't need to create a conditional policy for this user like is a service account in principal portal, It isn't an user in Azure AD /Entra Portal admin for create obrigatory a conditional access policy the same problem for ZIAD ALSAMAD. Right?
Cesar Lopez 225 Reputation points

2024-09-11T14:28:47.19+00:00

The admin account is not the same that service account. Service account is using for apps, other service and enterprise apps.

Then, any user that use a account or admin account to access to the Admin Portal or similar, must be use the MFA obligatory.

Share via

MFA REQUIRED NOTICED

0 additional answers

Your answer