Mandatory Multifactor Authentication Coming to Azure

Starting in October, Microsoft will require multifactor authentication (MFA) for all Azure sign-ins.

Microsoft said the policy change is in line with its current focus on enhancing digital security and complements its planned $20 billion in security spending over the next five years. The specific goal with requiring MFA is "to reduce the risk of unauthorized access by implementing and enforcing best-in-class standards across all identity and secrets infrastructure, and user and application authentication and authorization," the company said.

A security team at Microsoft released a report earlier in the year that found implementation of MFA can block 99.2% of all account compromise attacks, hence the push for requiring it in all Azure logins.

Microsoft said it plans to start rolling out the requirement in two phases. Beginning in October, MFA will be required for signing in to the Azure portal, Microsoft Entra admin center, and Intune admin center. This enforcement will gradually extend to all tenants worldwide, though it will not impact other Azure clients, such as Azure Command Line Interface (CLI), Azure PowerShell, Azure mobile app, and Infrastructure as Code (IaC) tools. Next, in early 2025, MFA enforcement will expand to include sign-ins for Azure CLI, Azure PowerShell, Azure mobile app, and IaC tools.

To prepare for the new policy, Microsoft has started issuing 60-day advance notice to all Entra global admins via e-mail and Azure Service Health Notifications. Additional alerts will be provided through the Azure portal, Entra admin center, and the Microsoft 365 message center. Here's how users can enable MFA:

  • Microsoft Authenticator allows users to approve sign-ins from a mobile app using push notifications, biometrics, or one-time passcodes. Augment or replace passwords with two-step verification and boost the security of your accounts from your mobile device.
  • FIDO2 security keys provide access by signing in without a username or password using an external USB, near-field communication (NFC), or other external security key that supports Fast Identity Online (FIDO) standards in place of a password.
  • Certificate-based authentication enforces phishing-resistant MFA using personal identity verification (PIV) and common access card (CAC). Authenticate using X.509 certificates on smart cards or devices directly against Microsoft Entra ID for browser and application sign-in.
  • Passkeys allow for phishing-resistant authentication using Microsoft Authenticator.
  • Finally, and this is the least secure version of MFA, you can also use a SMS or voice approval as described in this documentation.

For more information, read the Microsoft blog post.

About the Author

Chris Paoli (@ChrisPaoli5) is the associate editor for Converge360.

Featured

  • students using digital devices, surrounded by abstract AI motifs and soft geometric design

    Ed Tech Startup Kira Launches AI-Native Learning Platform

    A new K-12 learning platform aims to bring personalized education to every student. Kira, one of the latest ed tech ventures from Andrew Ng, former director of Stanford's AI Lab and co-founder of Coursera and DeepLearning.AI, "integrates artificial intelligence directly into every educational workflow — from lesson planning and instruction to grading, intervention, and reporting," according to a news announcement.

  • toolbox featuring a circuit-like AI symbol and containing a screwdriver, wrench, and hammer

    Microsoft Launches AI Tools for Educators

    Microsoft has introduced a variety of AI tools aimed at helping educators develop personalized learning experiences for their students, create content more efficiently, and increase student engagement.

  • laptop displaying a red padlock icon sits on a wooden desk with a digital network interface background

    Reports Point to Domain Controllers as Prime Ransomware Targets

    A recent report from Microsoft reinforces warns of the critical role Active Directory (AD) domain controllers play in large-scale ransomware attacks, aligning with U.S. government advisories on the persistent threat of AD compromise.

  • Two hands shaking in the center with subtle technology icons, graphs, binary code, and a padlock in the dark blue background

    Two Areas for K-12 Schools to Assess for When to Work with a Managed Services Provider

    The complexity of today’s IT network infrastructure and increased cybersecurity risk are quickly moving beyond many school districts’ ability to manage on their own. But a new technology model, a partnership with a managed services provider, offers a way forward for schools to overcome these challenges.