enforcing MFA

Question

I have users with global admin that are able to enable/enforce MFA for specific users in AD, but when other admins without this role try, they cannot (see screenshot). This particular admin trying does have Authentication Administrator and Priv. Authentication Admin roles assigned to them (but not global admin), as well as several other administrator roles. Is there one in particular that allows them to change this on users without assigning global admin? It also looks like if they click Manage User Settings on the same screen, that area is not changeable for them either.

Answer 1

Hi @Jennifer Moczulski ,

Are they trying to enable the MFA for an admin user by chance? If that's the case and they are using the Authentication Administrator role, that may be why they are unable to enable it. If you want to configure MFA for non-admin users, you can use the Authentication Administrator role. If you want to configure MFA for all users including admin users, you can use the Privileged Authentication Administrator role.

https://learn.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles

If you are using Azure AD Premium, another option is to enforce MFA on the user using Conditional Access, or leverage PIM to grant the elevated role temporarily.