People who are in scope of a Conditional Access policy will be prompted for one-time multi-factor authentication registration when they first sign in.

It is a flexible and straightforward means to break free from the old actor-action-resource model in Active Directory, but requires Azure AD Premium licenses.

Through enabling an Azure AD user object with multi-factor authentication.Ĭonditional Access policies are the preferred way to require multi-factor authentication and/or other apply other access restrictions, like requiring a compliant device or require a certain location (based on egress IP address).

Through Security Defaults, when the Azure AD account has a privileged role or is an Azure service owner.

In Azure Active Directory, there are three ways to require multi-factor authentication: Ways to require multi-factor authentication in Azure AD

It should not be used for several reasons. It allows for enforcing multi-factor authentication on a per-user basis. One of the remnants of the PhoneFactor infrastructure is an old page that is linked in the Azure Portal.

Azure ad multifactor authentication