Microsoft to Require Multi-Factor Authentication on Azure Portal Logins

Microsoft has announced a mandatory multi-factor authentication (MFA) requirement for all sign-in attempts to the Azure portal and other administrative interfaces, as part of a two-phase rollout.

Phase 1 targets Portal and Admin Interfaces, beginning in October 2024, with MFA required for sign-ins to the Azure portal, Microsoft Entra admin centre, or Microsoft Intune admin centre when performing create, read, update or delete operations; Phase 1 can be postponed to 30 September 2025 for tenants that need extra time.

Phase 2 expands MFA to command-line and API tools from 1 October 2025, including the Azure CLI, Azure PowerShell, the Azure mobile app, infrastructure-as-code tools and Control Plane REST API endpoints; read-only commands remain unaffected. Microsoft notes that organisations already enforcing MFA or using passwordless methods will see no change in their sign-in experience during Phase 1, while postponement options exist for Phase 2 until 1 July 2026.

According to Microsoft’s own research, enabling MFA can prevent over 99.2 per cent of account compromise attacks, making MFA one of the most effective defences against credential theft, and the company emphasises migrating user-based service accounts to secure workload identities for automation.