Skip to content
← Back to the guide

How to require MFA for all users with Conditional Access

8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 8

How to require MFA for all users with Conditional Access

How to require MFA for all users in Entra ID with Conditional Access: the exclusions that matter, report-only rollout, registration campaign, enforcement.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-require-mfa-for-all-users-with-conditional-access

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 8
01

Should I use security defaults or a Conditional Access policy to require MFA?

Security defaults if you have no Entra ID P1 licence — it is free and enforces MFA for everyone plus blocks legacy auth. Conditional Access if you have P1 (Business Premium, E3, E5): it lets you exclude break-glass acco…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-require-mfa-for-all-users-with-conditional-access

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 8
02

Does requiring MFA for all users break service accounts and scripts?

Any account that signs in interactively with a password and no second factor will be prompted, and non-interactive scripts using that account will fail. The fix is to stop using user accounts for automation — app regist…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-require-mfa-for-all-users-with-conditional-access

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 8
03

What is the difference between 'Require MFA' and 'Require authentication strength'?

Require MFA accepts any registered second factor, including SMS and voice. An authentication strength lets you choose which methods count — for example 'Passwordless MFA' or 'Phishing-resistant MFA' (FIDO2, Windows Hell…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-require-mfa-for-all-users-with-conditional-access

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 8
04

Step 1: Run a registration campaign

Authentication methods → Registration campaign nudges users who have not registered Authenticator at sign-in, with a snooze you can limit. Turn it on for all users two weeks before enforcement. Check progress in Entra →…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-require-mfa-for-all-users-with-conditional-access

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 8
05

Step 2: Create the policy in report-only

Entra → Protection → Conditional Access → New policy:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-require-mfa-for-all-users-with-conditional-access

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 8
06

Step 3: Create the admin policy alongside it

A second policy targeting directory roles (Global, Privileged Role, Security, Exchange, SharePoint, Conditional Access, User, Authentication Administrator and so on) with Require authentication strength → Phishing-resis…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-require-mfa-for-all-users-with-conditional-access

Slide 7Download PNG
M
solvingmicrosoft365.com
8 / 8
07

Step 4: Read the report-only results

A week of data: Sign-in logs → filter Conditional Access: Report-only → Failure shows who would have been blocked and why — nearly always user has not registered a method or a service account signing in with a password.…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-require-mfa-for-all-users-with-conditional-access

Slide 8Download PNG

Auto-generated from How to require MFA for all users with Conditional Access. This page is not indexed and isn't part of the guide itself.