🚦🟢👨💼CA - MFA for All Users
One factor is a rumour. This makes every interactive sign-in bring a second one, tenant-wide, and turns a leaked password from an incident into a footnote.
What this policy is about 🔐
A password is a secret that has, statistically, already stopped being one: dumped in a 2019 breach, or typed into a lookalike page last Tuesday. This policy stops treating it as the only lock. Every interactive sign-in, every user, every cloud app, brings a second factor. It is the floor the rest of the baseline stands on, so turn it on first and refine later.
"Require MFA" is the start, not the end. A code over SMS still counts, and still gets phished by a decent lookalike page. This kills password-only attacks; hardening the kind of MFA (phishing-resistant, admins first) is a later door.
Why this matters 🕵️
Most MKB breaches are not a zero-day. They are the right password in the wrong page, or a leaked one replayed from somewhere else. MFA is the deadbolt those attacks cannot pick, and it is the best return on any control in the tenant, already paid for in your licensing. The closest thing security has to a free lunch.
One catch: MFA only guards sign-ins that can do MFA. Legacy protocols cannot, and will not try. They hand over the mailbox on the password alone while this policy watches from the sidelines, blind. Which is why it never ships without the legacy-auth blocks.
🛠️ Configuration
Where: Entra admin center → Protection → Conditional Access → Policies.
| Setting | Value |
|---|---|
| Users, include | All users |
| Users, exclude | 🛡️🧑💼⛓️🔓🚦Group - Break the Glass solution + 26 admin directory roles (list below) |
| Target resources | All cloud apps, exclude Microsoft Intune (enrolment) |
| Grant | Require multifactor authentication |
| Session | None |
Admins are excluded here because they get a stricter policy, not a pass. Break-glass sits outside every MFA policy by design, so you can still get in when MFA itself is the outage. The Intune exclusion breaks the enrol-can't-MFA-can't-enrol loop.
The 26 excluded admin directory roles
Application Administrator · Application Developer · Authentication Administrator · Authentication Extensibility Administrator · Global Administrator · B2C IEF Keyset Administrator · Cloud Device Administrator · Cloud Application Administrator · Conditional Access Administrator · Directory Writers · Global Reader · Helpdesk Administrator · Password Administrator · Privileged Role Administrator · Security Administrator · Security Operator · Security Reader · Billing Administrator · Exchange Administrator · SharePoint Administrator · Compliance Administrator · Hybrid Identity Administrator · Knowledge Administrator · User Administrator · Teams Administrator · Privileged Authentication Administrator
Roll it out in Report-only first, read the sign-in logs for legacy clients and service accounts that would break, confirm break-glass is out, then flip to On. Break-glass leaves the building before enforcement, every time.
Caveats ⚠️
MFA and legacy auth are a package deal. Leave legacy auth open and the attacker just asks the tenant the old-fashioned way, skipping the prompt entirely. Ship the legacy blocks in the same breath, never after.
SMS counts as MFA the way a screen door counts as a door. Fine for the baseline, its job is killing password-only attacks. Just do not read "we have MFA" as "we are phishing-resistant".
Exemptions are pre-arranged breaches. Every excluded account is a password-only door with your name on the hinge. Keep the non-admin list at zero, and check who is actually excluded quarterly, because exclusions breed in the dark.
License and reversibility. P1, included in Business Premium, no upsell. Clean-revert, so a disabled MFA-for-all policy is a tenant that quietly went back to 2014. Alert on it.
🔗 Related
- 🚦🔴📜CA - Block Legacy Exchange Active Sync Clients + 🚦🔴📜CA - Block Legacy Other Clients: the mandatory partners. MFA means nothing while legacy auth can skip it.
- 🚦🟢👨💼CA - MFA for Admin Roles 4h: the stricter policy the admin exclusion hands off to.
- 🚦🟢👨💼CA - MFA for Guests: the same floor, for people not on your payroll.
Turn it on, exclude break-glass, block legacy auth in the same breath, and the most common attack on the internet stops working against your tenant before lunch. 🔐