Multi-Factor Authentication (MFA) provides a high level of protection for identities in the cloud. The user must identify himself with a second factor in addition to the password. Without this second factor, access to cloud apps are prevented.

The feature “Azure AD Conditional Access” can be used to enforce multi-factor authentication. At least two of the following authentication methods then become mandatory:

  • Something you know, typically a password
  • Something you have, such as a trusted device that’s not easily duplicated, like a phone or hardware key
  • Something you are – biometrics like a fingerprint or face scan

The following instructions show how to enable multi-factor authentication via Azure AD Conditional Access in your own tenant for all users and all guest users.

Prerequisites and Licensing

The following license is required to use the feature “Azure AD Conditional Access”:

  • Azure AD Premium P1

The license is included in “Microsoft 365 Business Premium” and many more.

An overview of Microsoft 365 license packages with their features can be found at
Thanks to Aaron Dinnage for this great overview!

Force Multi-Factor Authentication for all user accounts

Select “Azure AD Conditional Access” and create a new policy

The policy should be applied to all users in the tenant

Microsoft recommends to exclude the following accounts from multi-factor authentication and to use a very strong password (>24 characters) instead.

  • Break Glass Accounts / Emergency Accounts
  • Service Accounts
  • Service Principals

The exclusion of these accounts from this policy is configured as follows.

The policy should be applied to all cloud apps that authenticate with Azure AD. This includes Microsoft Cloud Apps (e.g. Microsoft 365 Portal, Azure Portal, etc.) as well as those applications that are integrated via Azure AD enterprise applications.

If a cloud app should be excluded, this can also be configured as shown below.

The policy should always be applied, so it does not require configuration of conditions.

Enforce “Multi-Factor Authentication” in the section “Access Control”

A multi-factor authentication token has a lifetime of 90 days.
The token is valid per device and must be renewed after the lifetime expires. It is recommended to reduce this lifetime to 30 days.

The “Report-only” option saves the policy, but does not yet activate the settings. This way the effects of the policy can be tested safely.

The effects of the policy can now be evaluated in the Azure Active Directory sign in logs.

After successful verification of the policy, it can be enabled.

Sponsored Links

Force Multi-Factor Authentication for all guest accounts

The configuration of the guest account policy is largely identical to that of the user accounts in the previous section.
The only difference is the assignment of the policy, where “All guest and external users” is explicitly selected.

Exclude the following accounts from this policy:

  • Break Glass Accounts
  • Service Accounts
  • Service Principals

The further configuration of the policy is identical to that of the user accounts and can be viewed here.

Follow me on LinkedIn and get informed about my latest posts.

Sponsored Links