Azure to Enforce MFA for All Resource Management Operations

Microsoft is extending its MFA rollout, with starting 1 October 2025 mandatory MFA for all resource management operations across Azure, including Azure CLI, PowerShell, SDKs, REST APIs and IaC tools. Phase 1 rolled out earlier for Azure Portal, Microsoft Entra admin centre and Intune admin centre sign-ins, reaching 100% enforcement for Azure tenants by March 2025.

Beginning 1 October 2025, users must authenticate with MFA before performing any resource management actions, while workload identities such as managed identities and service principals remain unaffected.

Microsoft is also notifying Microsoft Entra Global Administrators by email and via Azure Service Health alerts, and organisations are advised to enable MFA for all users, consider Azure Policy to block or audit non-MFA operations, update Azure clients to CLI v2.76 and PowerShell v14.3 or later, and plan to postpone enforcement if needed via the Azure Portal. According to Microsoft, MFA can block more than 99.2% of account compromise attacks, underscoring the security benefits of this phased enforcement.