Attack Simulator

[Bryan Kuester]

The Attack Simulator appears disabled with a message that says "You must enable multi-factor authentication (MFA) to schedule or terminate attacks." 

We have MFA Enabled on just about every account with the exception of a few that are not real user accounts (converted to shared mailboxes). 

Does every account have to have MFA enabled in order for this to work? 

[#2 · Accepted solution]

No. What you need is to have actually performed the MFA challenge before you access the page. It will check the access token for the presence of the "user has performed MFA" bit, and only let you manage the settings if this is true. Think of it as added security for one of the more sensitive features we have in O365.

[#3]

@Vasil Michev whats crazy is, what if you have conditional access policies applied to your org. MFA doesn't kick in for me when I am at work. So I need to go home and do this part of my job? lol.

-g

[#4]

@Greg Hogan 

this is also discussed here 

https://github.com/MicrosoftDocs/OfficeDocs-o365seccomp/issues/439

If Conditional access doesn't deem MFA to be a requirement for your given session, then yes you'll be blocked from the page. You might want to use one of the available methods within conditional access to exempt your session during that visit, or temporarily flip to a hotspot, etc.