CA Policy Deleted "Microsoft-managed: Require phishing-resistant multifactor authentication for admins "

Question

CA Policy Deleted "Microsoft-managed: Require phishing-resistant multifactor authentication for admins "

Piwowar, Jacek (Elevated) 10

We see that this policy ( Microsoft-managed: Require phishing-resistant multifactor authentication for admins ) was deleted . What was the reason and also what it was replaced with ?

Moved from Microsoft Security | Microsoft Authenticator

John R 6 Reputation points

2026-04-07T13:29:54.03+00:00

Just as importantly, why was this action not announced in advance or documented in the M365 Administration Message Center? We shouldn't have to Google to find out why Microsoft triggered our security system for something like this.
Doris V 1,450 Reputation points Microsoft External Staff Moderator

2026-04-08T06:58:24.0433333+00:00

Hi @John R

The deletion of the Microsoft managed Conditional Access policy “Require phishing resistant multifactor authentication for admins” was part of a backend service change, not a customer initiated or customer visible configuration update. Because of this, Microsoft treated the change as an internal transition rather than a tenant actionable feature change, which is why it was not surfaced in advance through the Microsoft 365 Message Center.

The intent behind the removal was to retire Microsoft managed Conditional Access policies as a class and shift responsibility to customer managed Conditional Access using authentication strengths. However, Microsoft acknowledges that the impact of this change, specifically the deletion of an existing policy object, was significant enough that it should have been communicated more clearly.

I hope you find this information helpful. If anything is unclear, please don’t hesitate to reach out to me.

Best regards.

1 answer

Your answer

John R 6 Reputation points

2026-04-07T13:29:54.03+00:00

Just as importantly, why was this action not announced in advance or documented in the M365 Administration Message Center? We shouldn't have to Google to find out why Microsoft triggered our security system for something like this.
Doris V 1,450 Reputation points Microsoft External Staff Moderator

2026-04-08T06:58:24.0433333+00:00

Hi @John R

The deletion of the Microsoft managed Conditional Access policy “Require phishing resistant multifactor authentication for admins” was part of a backend service change, not a customer initiated or customer visible configuration update. Because of this, Microsoft treated the change as an internal transition rather than a tenant actionable feature change, which is why it was not surfaced in advance through the Microsoft 365 Message Center.

The intent behind the removal was to retire Microsoft managed Conditional Access policies as a class and shift responsibility to customer managed Conditional Access using authentication strengths. However, Microsoft acknowledges that the impact of this change, specifically the deletion of an existing policy object, was significant enough that it should have been communicated more clearly.

I hope you find this information helpful. If anything is unclear, please don’t hesitate to reach out to me.

Best regards.

Answer 1

Hi @Piwowar, Jacek (Elevated),

According to your concern, the Microsoft managed policy titled “Require phishing‑resistant multifactor authentication for admins” was deleted intentionally by Microsoft and not due to an error.

The policy was not replaced by another Microsoft‑managed policy. Instead, it was replaced by the recommendation to create your own Conditional Access policy that targets administrator roles and requires the Phishing‑resistant MFA authentication strength.

Reference: Require phishing-resistant multifactor authentication for Microsoft Entra administrator roles - Mic…

If you have not already done so, make sure your environment has a Conditional Access policy in place that enforces phishing‑resistant MFA for admin roles to maintain the intended security posture.

Note: Please understand that as a forum moderator, my primary goal is to provide helpful guidance and support through general troubleshooting steps. While I don’t have access to internal systems or test devices required to resolve backend/account issues, I truly appreciate your understanding of these limitations.

I hope you find this information helpful. If anything is unclear, please don’t hesitate to reach out to me.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have any extra questions about this answer, please click "Comment."

If you want to receive the related email notification for this thread, please follow the steps in our documentation to enable e-mail notifications.

Share via

CA Policy Deleted "Microsoft-managed: Require phishing-resistant multifactor authentication for admins "

1 answer

Your answer