Blog Post

Microsoft 365 Blog
7 MIN READ

Announcing mandatory multifactor authentication for the Microsoft 365 admin center

Samer_Baroudi's avatar
Samer_Baroudi
Icon for Microsoft rankMicrosoft
Nov 11, 2024

Learn how multifactor authentication (MFA) can protect your organization and how to prepare for the upcoming Microsoft 365 admin center MFA requirement 

  Microsoft is committed to continuously enhancing security for all our users and customer organizations. One of the pillars of the Microsoft Secure Future Initiative is to protect identities and s...
Updated Nov 08, 2024
Version 1.0
microsoft 365
microsoft 365 admin center
GeogAlthaus's avatar
GeogAlthaus
Copper Contributor
Nov 26, 2024

Hi Samer_Baroudi 

You didn't really answer the question from VasilMichev
In the link you provided there is the ID 00000006-0000-0ff1-ce00-000000000000 mentioned. But is this the right one? There seems to be one for the new admin portal URL admin.cloud.microsoft (618dd325-23f6-4b6f-8380-4df78026e39b). And there are some user services which use the ID 00000006-0000-0ff1-ce00-000000000000 like https://portal.office.com/account/.

Can you please clarify this? Thanks Georg

  • v-vasulkars's avatar
    v-vasulkars
    Copper Contributor
    Jan 10, 2025

    Hi @GeogAlthaus, An App ID can be associated to multiple URLs which may or may not be in-scope for MFA enforcement. A better way to look at this is that Microsoft will be enforcing MFA for the Microsoft 365 admin center which is accessed via the following URLs: 'portal.office.com/adminportal/home' , 'admin.cloud.microsoft' , or 'admin.microsoft.com'. Note that 'portal.office.com/account' is the 'My Account' page and is not in-scope.

     

    • JonKilner's avatar
      JonKilner
      Brass Contributor
      Jan 13, 2025

      Hi v-vasulkars , interesting. I've not seen information in any blog posts or articles that reference the MFA is scoped to URLs as well as App IDs. Do you have a full list of the URLs that are going to be targeted by the MFA, rather than the App IDs.

      We're desperately trying to understand the scope of which users are going to be affected by this. We have ran impact reports and tried to create a report-only CA policy to understand the impact, neither of which would allow us to see URLs.

       

       

      • v-vasulkars's avatar
        v-vasulkars
        Copper Contributor
        Jan 14, 2025

        Hi @JonKilner, The URL's impacted are 'portal.office.com/adminportal/home' , 'admin.cloud.microsoft', or 'admin.microsoft.com'. Note that 'portal.office.com/account' is the 'My Account' page and is not in-scope. 

        The users that are impacted are notified through the Message center. 
        Thanks!