An action can be Multi-Factor Authentication. Figure 1: MFA on user-level Azure AD MFA via Conditional AccessĬonditional Access policies at their simplest are if-then statements if a user wants to access a resource, then they must complete an action.

An administrator can forget enabling Multi-Factor Authentication, which increases the risk of a successful password attack due to missing Multi-Factor Authentication. The risk by enabling Multi-Factor Authentication on a user-basis is misconfiguration since Multi-Factor Authentication is not enabled by default when creating a new user account. Disabled means that Multi-Factor Authentication is not enabled, and the user does not have to log in with a Multi-Factor. When the user goes through the Multi-Factor Authentication registration, the status changes to Enforced. The status Enabled indicates that Multi-Factor Authentication is enabled, but the user did not go through the Multi-Factor Authentication registration yet. There are three Multi-Factor Authentication statuses within Microsoft Office 365: Enabled, Enforced, and Disabled.

This blog post will describe the various technical implementations of Multi-Factor Authentication, including the best-practice to implement it.

There are multiple ways to enable Multi-Factor Authentication (MFA) within Microsoft Office 365.

Azure ad mfa setup