Enable MFA for Azure AD Users

Azure Active Directory (Azure AD) Multi-Factor Authentication helps safeguard access to data and applications, providing another layer of security by using a second form of authentication. Organizations can enable multifactor authentication (MFA) with Conditional Access to make the solution fit their specific needs.

This post is to summarize some key steps to plan and implement an Azure AD Multi-Factor Authentication roll-out.

Prerequisites

Authentication methods for MFA

• Windows Hello for Business
• Microsoft Authenticator app
• FIDO2 security key (preview)
• OATH hardware tokens (preview)
• OATH software tokens
• SMS verification
• Voice call verification

The following additional verification methods can be used in certain scenarios:

• App passwords – used for old applications that don’t support modern authentication and can be configured for per-user Azure AD Multi-Factor Authentication.
• Security questions – only used for SSPR
• Email address – only used for SSPR

Plan Conditional Access Policies

To create your own conditional access policies, and target specific conditions like Cloud apps, sign-in risk, and device platforms, you will need Azure AD Premium. 

Azure Active Directory Premium P1

Annual commitment – $92.40 / Licenses / year

Billed monthly – $7.70 / Licenses / month

Azure Active Directory Premium P2: A comprehensive cloud Identity and access management solution with advanced identity protection for all your users and administrators. From ‎$11.50‎ ‎licenses‎/month. 

Azure AD Multi-Factor Authentication is enforced with Conditional Access policies. These policies allow you to prompt users for MFA when needed for security and stay out of users’ way when not needed.

For end-to-end guidance on Azure AD Conditional Access deployment, see the Conditional Access deployment plan.

Common use cases to require Azure AD Multi-Factor Authentication include:

• For administrators
• To specific applications
• For all users
• For Azure management
• From network locations you don’t trust

Per-User MFA vs Conditional Access Based MFA

In your tenant, you can enable MFA on a per-user basis. In this scenario, your users perform MFA each time they sign in, with some exceptions, such as when they sign in from trusted IP addresses or when the remember MFA on trusted devices feature is turned on. 

For Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Users are prompted for MFA as needed, but you can’t define your own rules to control the behavior.

More about per-user MFA can be found:

• https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates

Enabling Per-User MFA:

Select a user, then from right column of quick action to enable it:

If your users do not regularly sign in through the browser, you can send them to this link to register for multi-factor auth: https://aka.ms/MFASetup

Based on your organization supported authentication method, you might get following screen with all available authentication methods:

While enabling MFA is a good practice, converting per-user MFA to MFA based on Conditional Access can reduce the number of times your users are prompted for MFA.

This recommendation shows up if:

• You have per-user MFA configured for at least 5% of your users.
• Conditional Access policies are active for more than 1% of your users (indicating familiarity with CA policies).

Convert per-user MFA enabled and enforced users to disabled

If your users were enabled using per-user enabled and enforced Azure AD Multi-Factor Authentication the following PowerShell can assist you in making the conversion to Conditional Access based Azure AD Multi-Factor Authentication.

Run this PowerShell in an ISE window or save as a .PS1 file to run locally. The operation can only be done by using the MSOnline module.

PowerShellCopy

# Connect to tenant
Connect-MsolService

# Sets the MFA requirement state
function Set-MfaState {
    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipelineByPropertyName=$True)]
        $ObjectId,
        [Parameter(ValueFromPipelineByPropertyName=$True)]
        $UserPrincipalName,
        [ValidateSet("Disabled","Enabled","Enforced")]
        $State
    )
    Process {
        Write-Verbose ("Setting MFA state for user '{0}' to '{1}'." -f $ObjectId, $State)
        $Requirements = @()
        if ($State -ne "Disabled") {
            $Requirement =
                [Microsoft.Online.Administration.StrongAuthenticationRequirement]::new()
            $Requirement.RelyingParty = "*"
            $Requirement.State = $State
            $Requirements += $Requirement
        }
        Set-MsolUser -ObjectId $ObjectId -UserPrincipalName $UserPrincipalName `
                     -StrongAuthenticationRequirements $Requirements
    }
}
# Disable MFA for all users
Get-MsolUser -All | Set-MfaState -State Disabled

Enable Azure AD MFA

Your Azure AD Multi-Factor Authentication rollout plan should include a pilot deployment followed by deployment waves that are within your support capacity. Begin your rollout by applying your Conditional Access policies to a small group of pilot users. After evaluating the effect on the pilot users, process used, and registration behaviors, you can either add more groups to the policy or add more users to the existing groups.

Follow the steps below:

1. Meet the necessary prerequisites
2. Configure chosen authentication methods
3. Configure your Conditional Access policies
4. Configure session lifetime settings
5. Configure Azure AD MFA registration policies

Operation: Manage Azure AD MFA

Reporting and Monitoring

Azure AD has reports that provide technical and business insights, follow the progress of your deployment and check if your users are successful at sign-in with MFA. Have your business and technical application owners assume ownership of and consume these reports based on your organization’s requirements.

You can monitor authentication method registration and usage across your organization using the Authentication Methods Activity dashboard. This helps you understand what methods are being registered and how they’re being used.

Sign in report to review MFA events

The Azure AD sign-in reports include authentication details for events when a user is prompted for MFA, and if any Conditional Access policies were in use. You can also use PowerShell for reporting on users registered for Azure AD Multi-Factor Authentication.

NPS extension and AD FS logs for cloud MFA activity are now included in the Sign-in logs, and no longer published to Security > MFA > Activity report.

For more information, and additional Azure AD Multi-Factor Authentication reports, see Review Azure AD Multi-Factor Authentication events.

References

• Plan an Azure Active Directory Multi-Factor Authentication deployment
• Optimize reauthentication prompts and understand session lifetime for Azure AD Multi-Factor Authentication
• Sure, keep me signed in! And don’t prompt for MFA!
• Tutorial: Secure user sign-in events with Azure AD Multi-Factor Authentication