There’s no way to point this at certain users or test it, you just have that one little switch to turn it on for every single account in your tenant.įor someone who had signed up for MFA, they were asked to confirm the details entered previously. As soon as someone who hadn’t signed up for MFA logged onto, they were prompted to go through the MFA registration process. Turning this option on is a company wide setting and from my testing, worked pretty much immediately.

This option is found under Azure Active Directory > Password reset > Registration, and is off by default. The description for this option is a bit misleading, it actually means that they’ll be prompted the NEXT time they log in, rather than the first time. If set to “No,” administrators must manually specify the necessary password reset authentication information in the properties for each user in this directory, or instruct users to go to the registration portal URL directly. Under the question mark: Designates whether unregistered users are prompted to register their own authentication information when they sign in for the first time. Require users to register when signing in?

Those without P2 however, have an option that’s a bit hidden, not as well known and slightly scary: If you’re fortunate enough to have Azure AD Premium P2 licensing, you can use a MFA registration policy to do a nicely managed rollout and force people on. Just enabling MFA with Conditional Access is great, but getting all users to actually register for MFA can be a challenge. Maybe you did and well done! For the rest of us though, we slowly move into these systems while turning more options on. It’s also likely you didn’t start with Mutli-Factor Authentication (MFA) in place and ready to go. It’s a long but rewarding path, with new features constantly being added to enhance a critical service in the Microsoft offerings.

If you’ve gone down the path of Azure Active Directory (Azure AD), then I dare say you’re not at the end.

Azure conditional access mfa