The user is enrolled in per-user Azure AD Multi-Factor Authentication, but can still use their password for legacy authentication. The default state for a user not enrolled in per-user Azure AD Multi-Factor Authentication. User accounts in Azure AD Multi-Factor Authentication have the following three distinct states: State Azure AD Multi-Factor Authentication user statesĪ user's state reflects whether an admin has enrolled them in per-user Azure AD Multi-Factor Authentication. Conditional Access doesn't change the state.ĭon't enable or enforce per-user Azure AD Multi-Factor Authentication if you use Conditional Access policies. Don't be alarmed if users appear disabled.

If you use Conditional Access or security defaults, you don't review or enable user accounts using these steps.Įnabling Azure AD Multi-Factor Authentication through a Conditional Access policy doesn't change the state of the user. This article details how to view and change the status for per-user Azure AD Multi-Factor Authentication. For more information on the different ways to enable MFA, see Features and licenses for Azure AD Multi-Factor Authentication. When users are enabled individually, they perform multi-factor authentication each time they sign in (with some exceptions, such as when they sign in from trusted IP addresses or when the remember MFA on trusted devices feature is turned on).Ĭhanging user states isn't recommended unless your Azure AD licenses don't include Conditional Access and you don't want to use security defaults. If needed, you can instead enable each account for per-user Azure AD Multi-Factor Authentication. Users are prompted for MFA as needed, but you can't define your own rules to control the behavior. To get started using Conditional Access, see Tutorial: Secure user sign-in events with Azure AD Multi-Factor Authentication.įor Azure AD free tenants without Conditional Access, you can use security defaults to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios. Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. To secure user sign-in events in Azure AD, you can require multi-factor authentication (MFA).

Enabling mfa office 365