Azure Sign-in Logs

Steph32UK 

This would be an example of how to implement the extra check: Conditional Access - Require MFA for Azure management - Azure Active Directory - Microsoft Entra | Microsoft Learn. This way they'd need to prove the second factor even if they gain access to valid credentials.

You could make a variant on this to just block Azure Management for non-admins similar to the example described here: Block access to Azure Powershell Management (microsoft.com) or Block user access to Azure AD Powershell with Conditional Access - Microsoft Community Hub. In this case, you'd want to put your admins in a group that's excluded from the rule.

Please like and mark this thread as answered if it's helpful, thanks!