Forum Discussion
Attack Simulator
The Attack Simulator appears disabled with a message that says "You must enable multi-factor authentication (MFA) to schedule or terminate attacks."
We have MFA Enabled on just about every account with the exception of a few that are not real user accounts (converted to shared mailboxes).
Does every account have to have MFA enabled in order for this to work?
No. What you need is to have actually performed the MFA challenge before you access the page. It will check the access token for the presence of the "user has performed MFA" bit, and only let you manage the settings if this is true. Think of it as added security for one of the more sensitive features we have in O365.
No. What you need is to have actually performed the MFA challenge before you access the page. It will check the access token for the presence of the "user has performed MFA" bit, and only let you manage the settings if this is true. Think of it as added security for one of the more sensitive features we have in O365.
It would be great if Microsoft has an online reference/documentation on all MS365/Defender XDR/Purview admin operations that require this "user has performed MFA" bit. I knew about the Attack Simulator based on an onlie documentation, but was caught by surprise in yet another case where I needed to turn on auditing in Purview (start recording user and admin activity) but received an error at the "Complete organizational setup" step.
VasilMichev whats crazy is, what if you have conditional access policies applied to your org. MFA doesn't kick in for me when I am at work. So I need to go home and do this part of my job? lol.
-g
this is also discussed here
https://github.com/MicrosoftDocs/OfficeDocs-o365seccomp/issues/439
If Conditional access doesn't deem MFA to be a requirement for your given session, then yes you'll be blocked from the page. You might want to use one of the available methods within conditional access to exempt your session during that visit, or temporarily flip to a hotspot, etc.
