Microsoft Entra IDCustomer intent: As an identity administrator, I want to plan for mandatory MFA for users who sign in to Azure portal so that my organization is prep…
In brief
Learn about mandatory multifactor authentication (MFA) enforcement for Azure, Microsoft 365, and other admin portals, and how to prepare your tenant.
What Entra admins need to know
Review the documentation change to determine whether it affects tenant configuration, security posture, or rollout plans.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
Open on Microsoft Learn ↗The comparison below is an extract of the Microsoft Learn article showing only the changed content. Open the full article for complete context.
Conditional Access requires a Microsoft Entra ID P1 or P2 license. If you can't use Conditional Access, enable security defaults.
You can self-enforce MFA by using built-in definitions in Azure Policy. To learn more and follow a step-by-step overview to apply these policy assignments in your environment, see Tutorial: Apply MFA self-enforcement through Azure Policy. Azure Policy supports both the Audit effect (which reports noncompliance in policy compliance results) and the Deny effect, which blocks noncompliant requests.
For the best compatibility experience, ensure users in your tenant are using Azure CLI version 2.76 and Azure PowerShell version 14.3 or later. Otherwise, you can expect to see error messages as explained in these topics:
@@ -3,7 +3,7 @@ title: Plan for mandatory Microsoft Entra multifactor authentication (MFA) description: Learn about mandatory multifactor authentication (MFA) enforcement for Azure, Microsoft 365, and other admin portals, and how to prepare your tenant. ms.topic: concept-article ms.date: 04/03/2026-ms.reviewer: shahjoy+ms.reviewer: shahjoy, nehakulkarni ms.custom: sfi-ga-nochange, msecd-doc-authoring-106 # Customer intent: As an identity administrator, I want to plan for mandatory MFA for users who sign in to Azure portal so that my organization is prepared before enforcement begins. ---@@ -185,7 +185,7 @@ To prepare for MFA enforcement, configure a [Conditional Access policy](how-to-m Conditional Access requires a Microsoft Entra ID P1 or P2 license. If you can't use Conditional Access, enable [security defaults](~/fundamentals/security-defaults.md). -You can self-enforce MFA by using built-in definitions in Azure Policy. To learn more and follow a step-by-step overview to apply these policy assignments in your environment, see [Tutorial: Apply MFA self-enforcement through Azure Policy](/azure/governance/policy/tutorials/mfa-enforcement).+You can self-enforce MFA by using built-in definitions in Azure Policy. To learn more and follow a step-by-step overview to apply these policy assignments in your environment, see [Tutorial: Apply MFA self-enforcement through Azure Policy](/azure/governance/policy/tutorials/mfa-enforcement). Azure Policy supports both the `Audit` effect (which reports noncompliance in policy compliance results) and the `Deny` effect, which blocks noncompliant requests. For the best compatibility experience, ensure users in your tenant are using Azure CLI version 2.76 and Azure PowerShell version 14.3 or later. Otherwise, you can expect to see error messages as explained in these topics: