MFA not working with free plan

Question

Hi there,

I just started to setup Azure AD with the free plan and I would like to use MFA. According to the documentations it should be possible to use MFA with the free plan by enabling the "Security Defaults".
Even though "Security Defaults" are enabled, new created users are not getting asked to setup MFA while logging in and can access the Azure Portal just by using username+password (tested with browser in private mode).

The intended behaviour is described here:
https://learn.microsoft.com/en-us/azure/active-directory/authentication/multi-factor-authentication-faq

Is there a free version of Azure Multi-Factor Authentication?

Security defaults can be enabled in the Azure AD Free tier. With security defaults, all users are enabled for multi-factor authentication using the Microsoft Authenticator app. There's no ability to use text message or phone verification with security defaults, just the Microsoft Authenticator app.

How can I enable MFA with the free plan?

The same is written here as well with some more details:
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing

Azure AD free You can use security defaults to enable multi-factor authentication for all users, every time an authentication request is made. You don't have granular control of enabled users or scenarios, but it does provide that additional security step.
Even when security defaults aren't used to enable multi-factor authentication for everyone, users assigned the Azure AD Global Administrator role can be configured to use multi-factor authentication. This feature of the free tier makes sure the critical administrator accounts are protected by multi-factor authentication.

How can I configure Azure AD users with Global Administrator role to use MFA when "Security Defaults" are turned off?

Best regards,

Fabian

Answer 1

Hi,

There are two (2) ways to secure user sign-in events by requiring multi-factor authentication in Azure AD.

1. The preferred option is to set up a Conditional Access policy that requires multi-factor authentication under certain conditions.

Conditional Access: Require MFA for all users
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa

2. The second option is to enable each user for Azure Multi-Factor Authentication.

Enable per-user Azure Multi-Factor Authentication to secure sign-in events
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates

Best regards,
Leon