Emergency access or break-glass accounts to prevent tenant-wide account lockout.

User exclusionsĬonditional Access policies are powerful tools, we recommend excluding the following accounts from your policies: Organizations can choose to include or exclude roles as they see fit.

Privileged authentication administrator.

Microsoft recommends you require MFA on the following roles at a minimum, based on identity score recommendations: Requiring multifactor authentication (MFA) on those accounts is an easy way to reduce the risk of those accounts being compromised.

In the dialog box that opens, choose enable multi-factor auth.Accounts that are assigned administrative rights are targeted by attackers.

On the right, under quick steps, you'll see Enable and Manage user settings.

Select the check box next to the people for whom you want to enable MFA.

Otherwise, they will be prompted to complete the process the next time they sign in. If they have completed the registration process, then they are using MFA.

Enforced - The person may or may not have completed registration.

They will be prompted to complete the process the next time they sign in.

Enabled - The person has been enrolled in MFA, but has not completed the registration process.

The views have the following values, based on the MFA state of the users: In order to see everyone, you might need to change the Multi-Factor Auth status view at the top.

Find the people for whom you want to enable MFA.

Choose More > Setup Azure multi-factor auth.

How to Enable MFA for Office 365 users? Set up Multi-Factor Authentication for Office 365 Users

Office 365 enable mfa