Microsoft Automatically Deploying MFA Policies

Microsoft has started automatically deploying Microsoft-managed conditional access policies that may impact how your employees access Microsoft 365 based resources. The policies address multi-factor authentication for users and administrators and are deployed automatically in Report-only mode; however, without administrative action, the policies will automatically be enabled after ninety (90) days, which may impact user and admin logins into Microsoft 365 resources. Microsoft allows Entra administrators to edit the state of these policies (On, Off, or Report-Only) before the Report-Only timeframe expires.

Microsoft documentation related to Microsoft-managed polices is located at this link: https://learn.microsoft.com/en-us/entra/identity/conditional-access/managed-policies#multifactor-authentication-for-per-user-multifactor-authentication-users.

Authored by: David Bentley, CISSP