Blog Post

Core Infrastructure and Security Blog

3 MIN READ

Microsoft will require MFA for all Azure users

Microsoft

May 14, 2024

This July, Azure teams will begin rolling out additional tenant-level security measures to require multi-factor authentication (MFA). Establishing this security baseline at the tenant level puts in place additional security to protect your cloud investments and company.

MFA is a security method commonly required among cloud service providers and requires users to provide two or more pieces of evidence to verify their identity before accessing a service or a resource. It adds an extra layer of protection to the standard username and password authentication.

The roll-out of this requirement will be gradual and methodical to minimize impact on your use cases. The blog post below provides helpful information from the Azure product team to assist you in getting ready to MFA-enable your access to Azure services. Going forward, the team will provide communications to you about your specific roll-out dates through direct emails and Azure Portal notifications. Expect these in the coming months.

Read on to learn why and how MFA is important to securing customers on Azure and your workloads, environments, and users.

If you do not want to wait for the roll-out, set up MFA now with the MFA wizard for Microsoft Entra.

- Erin

How MFA works

Multi-factor authentication (MFA) is a security method that requires users to provide two or more pieces of evidence to verify their identity before accessing a service or a resource. The evidence can be something the user knows (such as a password or a PIN), something the user has (such as a phone or a token), or something the user is (such as a fingerprint or a face scan).

MFA adds an extra layer of protection to the standard username and password authentication, making it harder for attackers to compromise accounts and steal data. MFA can also help prevent unauthorized access due to phishing, credential stuffing, brute force, or password reuse attacks.

Entra ID supports various MFA methods, such as Microsoft Authenticator app, SMS, voice call, and hardware tokens. Users can choose the method that suits their preferences and needs. Admins can also use Entra ID Conditional Access policies to tune when MFA is required based on signals such as the user’s location, device, role, or risk level.

Why MFA is important for Azure tenant security

The need for MFA is more important than ever, as cyberattacks are becoming more frequent, sophisticated, and damaging. According to a report by Microsoft, 99.9% of compromised accounts did not use MFA. The report also found that MFA can block more than 99.2% of account compromise attacks, making it one of the most effective security measures available.

The rise of the hybrid workforce and accelerated digital transformation of businesses by the COVID-19 pandemic expanded risk scenarios for employees and companies. Today, more people work outside of the office and access data and applications from various devices and locations. All of this has increased the attack surface and the potential for unauthorized access, as users may use unsecured networks, devices, or passwords. MFA can help mitigate these risks by adding an extra verification step and preventing access from unknown or suspicious sources.

MFA is also a key component of identity and access management, which involves ensuring that only authorized and authenticated users can access the services and resources. One of the three areas of engineering advancements within Microsoft’s Secure Future Initiative focuses on implementing new identity protections and MFA at the tenant level helps you with identity protections. MFA not only reduces the risk of account compromise and data breach, but it also helps you comply with various security standards and regulations, such as PCI DSS, HIPAA, GDPR, and NIST.

Don’t wait to set up MFA

To help you keep users and data safe, MFA is now available and free for you to enable at the tenant level. You can set up MFA today with the MFA wizard for Microsoft Entra.

If you have additional questions, please review the MFA FAQ on Microsoft Learn for more information and learn more about the Secure Future Initiative and Microsoft’s built-in security features here.

Updated May 17, 2024

Version 4.0

Announcement

ErinChapple

Erin Chapple (BOURKE-DUNPHY)

Microsoft

Joined June 13, 2017

View Profile

Core Infrastructure and Security Blog

Follow this blog board to get notified when there's new activity

116 Comments

VNJoe
Iron Contributor
Aug 29, 2024
Yes you have to pay for it, and it's not cheap. It's an additional $6 US per user to protect a $4 Plan 1 mailbox. Pretty outrageous to charge for basic security.

From the Entra site, it doesn't say MFA is included:

Microsoft Entra ID has a free edition that provides user and group management, on-premises directory synchronization, basic reports, self-service password change for cloud users, and single sign-on (SSO) across Azure, Microsoft 365, and many popular SaaS apps. The free edition is included with a subscription of a commercial online service such as Azure, Microsoft 365, Dynamics 365, Intune, or Power Platform.
DavidStone
Copper Contributor
Aug 29, 2024
I have been using a third party add-on to Acrobat to send thousands of emails via SMTP mail - this worked well until two months ago using an APP password - but then failed with no reason, attempted to fix, regenerate new APP password, checked all software updated.

only fix was to create a new email account without MFA. All other methods have failed, (as for the password well it makes an APP password look simple)

why not allow users to use extremely complex password 25 or 30 characters?
AlanLaPietra
Microsoft
Aug 29, 2024
MFA is also available in Entra ID Free edition
TonyRedmond
MVP
Aug 29, 2024
At this point, the old-style per-user MFA is going away, so to impose MFA on user accounts you should use conditional access policies. Use of CA requires Entra P1, so that's where the licensing requirement arises. But this requirement covers just a very small set of accounts and those (admin) accounts should be protected by MFA anyway, so the net increase is likely very small.
wwiseman
Copper Contributor
Aug 29, 2024
Am I missing something? Looking for some clarification. I understand MFA and agree it should be used to secure your accounts, however am I correct in that one will need to 'pay' for a premium license (Entra ID) just to enable MFA for your Azure account? For example, as an individual dev with a 'non-corporate' pay as you go subscription in Azure, is this going to require them to purchase a premium license just to enable MFA on 'the' azure account itself so they can log in? This is what some are being led to believe from a conversation on another 'non-Microsoft' forum.
owainwtb
Iron Contributor
Aug 29, 2024
Does anyone know the Enterprise Application ID related to Intune as related to this change?
This updated blog gives the ID's for the Azure Portal (used by both the Azure portal and the Entra ID admin portal), Azure CLI and Azure PowerShell but does not make any mention of Intune.
The MS provided report https://aka.ms/AzMFA also only covers these 3 and not Intune.
TonyRedmond
MVP
Aug 22, 2024
Sometimes I feel like Copilot wrote the announcements and didn't really understand what the issue was about...

In any case, anyone reading this post should also read Microsoft's follow up post https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/update-on-mfa-requirements-for-azure-sign-in/ba-p/4177584?WT.mc_id=M365-MVP-9501 to understand the full context of the announcement. Or read my version where I attempt to boil the issue down to the 4 points mentioned a few replies ago. https://office365itpros.com/2024/08/19/azure-mfa-requirement/
kvtobola
Copper Contributor
Aug 22, 2024
For AD sync - the account you are asking about, what role(s) does that account have?

If it has global administrator, you should really think about using a different account or changing that account from global administrator to Hybrid Identity Administrator.

From the above, I would ask if an account has Hybrid Identity Administrator are they required to register for MFA.

I feel like I’ve seen information saying administrators only and/or information saying only accounts accessing the portal and CLI.

So the word administrators is kind of subjective here.
defragexe
Copper Contributor
Aug 22, 2024
Thank you Tony for your clarifications, that's helpful and yes if an on premises account is compromised it would be bad for them to have additional roles, yet in this particular edge case there isn't even a subscription in Azure. Nevertheless I will ask my people to review it with your link!

Maybe the title of the announcement has to be adjusted?
"Microsoft will require MFA for all Azure users****"

with

"Microsoft to enforce MFA within Azure administration tools. Regular operations unaffected."
TonyRedmond
MVP
Aug 22, 2024
On-premises accounts that hold Entra administrative roles are a really bad idea because they allow an attacker that compromises the on-premises environment a route into the cloud. This is especially true for accounts holding the global administrator role. Here's how to report if you do have accounts in that category https://office365itpros.com/2024/08/20/administrative-role-assignments/

But even if you have on-premises accounts with Entra roles, the question of MFA only arises if these accounts attempt to connect to the Azure sites/tools. If this happens, the accounts must be able to satisfy an MFA challenge. Synchronization doesn't come into the question. It's all about the connection.

As to Power Apps, why would accounts used to run workflows need to go anywhere near the Azure sites/tools? MFA is only required when accessing the Azure sites/tools.