MFA & Authentication¶

Authentication Strengths¶

Authentication Strengths define a named set of allowed authentication method combinations. The two CA policies "Enforce 2FA for All Users" and "Enforce 2FA for Admins" reference custom strengths rather than the basic "Require MFA" grant — this prevents weaker methods (e.g., SMS OTP) from satisfying the MFA requirement.

Entra admin center → Entra ID → Authentication methods → Authentication strengths → + New authentication strength

Standard MFA (for all users)¶

Allowed method combinations:

Admin MFA (for admin roles)¶

Allowed method combinations — all of Standard MFA, plus:

Authentication Methods Policy¶

Configure authentication methods at: Entra admin center → Entra ID → Authentication methods → Policies

Recommended Methods (enable for all users)¶

Microsoft Authenticator Settings¶

Enable passwordless phone sign-in and number matching to prevent MFA fatigue attacks:

Navigate to: Authentication methods → Microsoft Authenticator → Configure

Self-Service Password Reset (SSPR)¶

Entra admin center → Entra ID → Password reset

Per-User MFA Status (Legacy)¶

Avoid managing MFA via the legacy per-user portal when CA policies are in use — they conflict. Check there are no users in the Enforced state unless intentional:

Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All"

# List users without any MFA method registered
$users = Get-MgUser -All -Property Id,DisplayName,UserPrincipalName
foreach ($user in $users) {
    $methods = Get-MgUserAuthenticationMethod -UserId $user.Id
    if ($methods.Count -le 1) {  # Only "Password" method
        Write-Output "$($user.DisplayName) | $($user.UserPrincipalName) — NO MFA registered"
    }
}

Temporary Access Pass (TAP)¶

Use TAP for new user onboarding and for recovering locked-out accounts.

Entra admin center → Entra ID → Authentication methods → Temporary Access Pass

Generating a TAP for a user¶

Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All"

$tapBody = @{
    startDateTime    = (Get-Date).ToUniversalTime().ToString("o")
    lifetimeInMinutes = 60
    isUsableOnce     = $true
}

New-MgUserAuthenticationTemporaryAccessPassMethod -UserId "user@domain.com" -BodyParameter $tapBody

Password Protection¶

Entra admin center → Entra ID → Authentication methods → Password protection

Admin Account Best Practices¶

• Dedicated cloud-only admin accounts (e.g., admin.jsmith@domain.com) — no email license, leave as the .onmicrosoft account
• Admin accounts not used for day-to-day email/productivity tasks
• All admin accounts have MFA registered (FIDO2 preferred)
• Minimum 2, maximum 4 Global Administrators