SFA versus MFA in 365 sign in logs

[Marvin Oco]

all of our users have enforced MFA

Issue is that when you look at the sign-in logs there are SFA entries

all sign in should be MFA

what causes the SFA logs?

any known fix?

tnx

[#2 · Accepted solution]

Have you disabled Legacy authentication across all users/workloads? PowerShell scripts, devices sending email, third-party aps - all will default to using legacy auth/single factor.