Azure mandatory multifactor authentication: Phase 2 starting in October 2025

According to Microsoft Azure Blog, Microsoft Azure is announcing the start of Phase 2 multifactor authentication enforcement at the Azure Resource Manager layer, beginning 1 October 2025. The move follows Phase 1, which saw MFA enforcement on Azure Portal, Microsoft Entra admin centre, and Intune admin centre sign-ins reach 100% of Azure tenants in March 2025.

Phase 2 enforcement will be gradually applied across tenants via Azure Policy, targeting users performing resource management operations through any client, including but not limited to Azure CLI, Azure PowerShell, Azure Mobile App, REST APIs, SDKs, and IaC tools. Starting this week, notices have been sent to all Microsoft Entra Global Administrators by email and through Azure Service Health notifications to inform about the enforcement start date and preparation steps.

To prepare, organisations should enable MFA for their users by 1 October 2025 and consider applying a built‑in Azure Policy definition in audit or enforcement mode. Workloads such as managed identities and service principals are not impacted by Phase 1 or Phase 2 of the enforcement.