In October 2024, Microsoft began enforcing multi-factor authentication (MFA) for all users signing in to the Azure Portal, Microsoft Entra Admin Center, and Intune Admin Center. This change is part of a phased rollout to improve cloud security across all Microsoft services. Now, many organizations have already seen these changes take effect.
But the rollout isn’t over yet. Phase two is just beginning, targeting sign-ins through tools like Azure CLI, Azure PowerShell, the Azure mobile app, and Infrastructure as Code (IaC) tools.
If your team hasn’t fully prepared for this second wave of MFA enforcement, now is the time to act.
What Is Azure MFA and Why Does It Matter?
Azure MFA adds an extra layer of security when users log into Microsoft systems. Instead of relying on only a password, users must verify their identity through another method. This could be a text message, an authentication app, or a fingerprint.
This makes it much harder for attackers to gain access, even if they’ve stolen a password.
Microsoft is making this change because password-based attacks are on the rise. According to Microsoft, enabling MFA blocks 99.9% of account compromise attempts. With Azure being a key part of many businesses' daily operations, securing access with MFA helps protect data, users, and systems from unauthorized access.
Microsoft’s MFA Rollout Timeline
Microsoft’s mandatory Azure MFA rollout is happening in two major phases.
One that began in late 2024 and another starting in mid-2025.
Phase 1 (October 2024):
The first phase required MFA for signing into key admin portals:
- Azure Portal
- Microsoft Entra Admin Center
- Intune Admin Center
This update was gradually rolled out to all tenants worldwide. Most organizations have already experienced this change, and users must now complete MFA to access these web-based tools.
Phase 2 (Starting mid-2025):
This next phase is now underway. It expands MFA enforcement to tools often used by developers and IT teams, including:
- Azure Command Line Interface (CLI)
- Azure PowerShell
- Azure mobile app
- Infrastructure as Code (IaC) tools
These are commonly used in automated processes and custom scripts, so this phase introduces new complexity. Microsoft understands this and is giving customers more time to adapt if they have technical barriers or complex environments.
Admins were notified at least 60 days in advance through email, the Azure portal, and other Microsoft channels.
If your team relies on any of these tools and hasn't prepared, now is the moment to plan your next steps. Delay could lead to disruptions.
What Will Change for Organizations and Admins
The biggest shift is that multi-factor authentication (MFA) will no longer be optional for Azure users. It’s becoming mandatory.
By the end of 2025, 99% of cloud security failures will be the customer’s fault, largely due to misconfigurations or poor identity practices.
Admins and end users will need to use an additional verification step (like a text, phone call, or authenticator app) to access key Microsoft tools. This change will affect how teams log in, manage permissions, and automate tasks.
Organizations that rely heavily on scripting or automated workflows will need to make sure those tools are MFA-compatible or adjust their processes.
Admins will also have to stay ahead of user issues. That means ensuring users are enrolled in MFA ahead of time, updating documentation, and preparing for questions once the change is live.
Why Microsoft Is Enforcing This Now
Cyber threats are rising fast, and Microsoft is taking action to protect customer environments.
Stolen credentials remain one of the top causes of data breaches. According to Verizon’s 2024 Data Breach Investigations Report, over 60% of breaches involved weak or stolen passwords. MFA is one of the most effective ways to stop unauthorized access, especially in cloud environments like Azure.
By enforcing MFA across all access points, Microsoft is raising the baseline for security. They’ve already made MFA a requirement for Microsoft 365 admins.
Now it’s Azure’s turn.
This is about risk prevention. But it’s also about making sure every tenant, regardless of size or complexity, has basic protections in place.
What Does Azure MFA Mean for IT Departments and MSPs?
For IT departments, this means updating access policies, tools, and support procedures.
You’ll need to make sure all admin accounts and user roles are enrolled in MFA. That includes non-human users like scripts, service principals, and automated tools.
Especially as Phase 2 kicks in.
MSPs (managed service providers) have even more to think about. Supporting multiple clients means configuring MFA across different environments. Clients may have custom tools, older systems, or users unfamiliar with MFA, all of which add complexity.
Planning ahead is essential. The more you delay, the more pressure your team will feel when enforcement hits full speed. Clear communication, MFA readiness audits, and documentation updates will save time and headaches.
How to Prepare for Mandatory Azure MFA
The best thing organizations can do right now is plan ahead.
Start by identifying which users and systems will be affected.
This includes admin accounts, general users, and any tools that interact with the Azure portal, Microsoft Entra admin center, or Intune admin center. Make sure all of these accounts are ready to use multi-factor authentication.
Next, check your current MFA policies in Microsoft Entra. If MFA isn’t already required for key accounts, begin phasing it in manually. This gives your team a chance to test, adapt, and train before Microsoft makes it mandatory.
Don’t forget to include user education in your rollout plan. Many issues come from simple confusion or a lack of training.
Tips for a Smooth MFA Rollout
Don’t wait for enforcement deadlines to act.
Roll out MFA in phases, starting with your IT and admin teams. This helps you troubleshoot any issues before rolling it out to your full user base.
Provide clear, simple instructions for how to register MFA methods like text messages, phone calls, or authenticator apps. Keep support documentation easy to access.
Hold short training sessions or drop-in office hours for users with questions. Communicate early and often so users aren’t caught off guard. And if you use scripts or automation tools, confirm they support secure access methods such as service principals with certificate-based authentication.
Finally, document your plan. Keep track of what you’ve already updated, what’s still pending, and what to monitor after rollout. This will help keep your team aligned as Microsoft moves into Phase 2.
Addressing Complex Environments
Some organizations may have legacy tools or unique workflows that make MFA setup more complicated.
If that’s the case, start by evaluating the specific systems or users that may need special attention. Microsoft has said they’ll consider extended timeframes for customers with complex environments, but that flexibility shouldn’t be taken for granted.
The sooner you identify and flag these areas, the more time you’ll have to create workarounds or request support.
For example, automated tools or Infrastructure as Code (IaC) solutions may require updated authentication methods. Service accounts and custom integrations should be reviewed to ensure they won’t break once MFA is enforced.
It’s also smart to coordinate with your MSP or security partner early. Together, you can map out dependencies, test access controls, and submit extension requests if needed. Being proactive now can save your team from disruption later.
Security and Compliance Benefits of Mandatory MFA
Mandatory MFA meets Microsoft’s new rules. But it’s also a big win for your security.
Multi-factor authentication blocks over 99% of account takeover attacks, according to Microsoft. It stops attackers who get your password from easily logging in. This one extra step of entering a code from your phone makes a massive difference.
Using MFA also supports compliance with many data protection standards, including HIPAA, PCI-DSS, and ISO 27001. If your business works in a regulated industry, this rollout helps meet key security requirements without needing to start from scratch.
You’ll also be in a better position during audits or vendor reviews.
What Happens If You Don’t Prepare
If you don’t prepare, things can go sideways fast.
Users may get locked out of essential portals like Azure or Intune with no warning. Admins could lose access during critical updates or troubleshooting. Your IT team will be swamped with last-minute help requests, and recovery can be messy.
Especially if backup methods aren’t configured ahead of time.
Beyond access issues, skipping preparation puts your entire environment at risk. Weak or outdated sign-in methods leave gaps for attackers. And by the time something breaks, it’s too late to set up MFA without delays or downtime.
It’s Time to Start Preparing for Azure MFA
Microsoft isn’t waiting, and neither should you.
Whether you’ve already enabled MFA or haven’t started, this is your moment to act. The earlier you prepare, the smoother your rollout will be. And the more secure your environment becomes.
Here at Makios, we’ll help you take time to evaluate your users, tools, and systems. Build a rollout plan, educate your team, and ask for help where needed.
MFA is no longer optional, and the smartest move is to stay ahead of the deadline.
today so we can provide the support you need during this transition.
