Microsoft Enforces MFA for Logging into Azure Portal

Microsoft has announced that it will make multifactor authentication (MFA) mandatory for all sign-ins to the Azure portal and related administrative centres, a policy first introduced in 2024. The move, disclosed on 26 August 2025, aims to dramatically reduce account compromise by adding an extra layer of identity verification across Azure and Microsoft 365 admin portals.

Enforcement is rolling out in two phases: Phase 1 runs from October 2024 to February 2025 and covers sign-ins for Azure portal, Microsoft Entra admin centre, Microsoft Intune admin centre, and Microsoft 365 admin centre requirements in February 2025; Phase 2 begins on 1 October 2025 and extends MFA to Azure CLI, Azure PowerShell, the Azure mobile app, Infrastructure as Code tools, and REST API endpoints, with read-only operations remaining exempt.

Administrators relying on scripted automation are advised to transition to workload identities, such as managed identities or service principals, to avoid disruption when Phase 2 starts. Microsoft also notes that MFA blocks over 99.2 per cent of account compromise attacks, underscoring MFA as a key defence for cloud resources.