• Article
  • 5 minutes to read

To secure user sign-in events in Azure Ad, you can crave multi-factor hallmark (MFA). Enabling Azure AD Multi-Gene Authentication using Conditional Admission policies is the recommended approach to protect users. Provisional Access is an Azure Advertising Premium P1 or P2 feature that lets you apply rules to require MFA equally needed in sure scenarios. To go started using Provisional Admission, see Tutorial: Secure user sign-in events with Azure Advertising Multi-Factor Authentication.

For Azure Advertizement free tenants without Conditional Admission, you lot can use security defaults to protect users. Users are prompted for MFA as needed, but you can't define your own rules to command the behavior.

If needed, you lot can instead enable each account for per-user Azure Advertising Multi-Factor Hallmark. When users are enabled individually, they perform multi-factor authentication each time they sign in (with some exceptions, such equally when they sign in from trusted IP addresses or when the remember MFA on trusted devices feature is turned on).

Changing user states isn't recommended unless your Azure AD licenses don't include Provisional Access and you don't want to utilise security defaults. For more than information on the different ways to enable MFA, see Features and licenses for Azure AD Multi-Factor Authentication.

Of import

This article details how to view and modify the status for per-user Azure Advertizement Multi-Gene Authentication. If you use Provisional Access or security defaults, you lot don't review or enable user accounts using these steps.

Enabling Azure AD Multi-Factor Authentication through a Provisional Access policy doesn't change the state of the user. Don't be alarmed if users announced disabled. Conditional Admission doesn't change the country.

Don't enable or enforce per-user Azure AD Multi-Factor Authentication if you employ Conditional Access policies.

A user's country reflects whether an admin has enrolled them in per-user Azure Advertizing Multi-Factor Authentication. User accounts in Azure AD Multi-Gene Authentication take the following iii distinct states:

State Description Legacy hallmark affected Browser apps affected Modern authentication afflicted
Disabled The default state for a user non enrolled in per-user Azure AD Multi-Gene Authentication. No No No
Enabled The user is enrolled in per-user Azure AD Multi-Gene Authentication, but tin can nonetheless use their password for legacy authentication. If the user hasn't yet registered MFA hallmark methods, they receive a prompt to register the side by side time they sign in using modern authentication (such equally via a web browser). No. Legacy hallmark continues to piece of work until the registration procedure is completed. Yeah. Later on the session expires, Azure Advertizement Multi-Factor Authentication registration is required. Yes. After the access token expires, Azure Advertisement Multi-Cistron Authentication registration is required.
Enforced The user is enrolled per-user in Azure Advert Multi-Cistron Authentication. If the user hasn't yet registered authentication methods, they receive a prompt to register the next time they sign in using mod hallmark (such as via a web browser). Users who complete registration while in the Enabled state are automatically moved to the Enforced land. Yes. Apps require app passwords. Yes. Azure AD Multi-Gene Authentication is required at sign-in. Yes. Azure AD Multi-Factor Hallmark is required at sign-in.

All users start out Disabled. When yous enroll users in per-user Azure AD Multi-Factor Authentication, their state changes to Enabled. When enabled users sign in and consummate the registration process, their state changes to Enforced. Administrators may move users between states, including from Enforced to Enabled or Disabled.

Note

If per-user MFA is re-enabled on a user and the user doesn't re-register, their MFA state doesn't transition from Enabled to Enforced in MFA direction UI. The administrator must movement the user direct to Enforced.

View the status for a user

To view and manage user states, complete the following steps to access the Azure portal page:

  1. Sign in to the Azure portal as a Global ambassador.
  2. Search for and select Azure Active Directory, then select Users > All users.
  3. Select Per-user MFA. You may demand to scroll to the right to see this menu option. Select the case screenshot below to run into the total Azure portal window and bill of fare location: Select Multi-Factor Authentication from the Users window in Azure AD.
  4. A new folio opens that displays the user state, as shown in the following example. Screenshot that shows example user state information for Azure AD Multi-Factor Authentication

Change the condition for a user

To change the per-user Azure Ad Multi-Factor Authentication country for a user, consummate the following steps:

  1. Apply the previous steps to view the status for a user to go to the Azure AD Multi-Gene Authentication users folio.

  2. Find the user you want to enable for per-user Azure Advertizement Multi-Factor Hallmark. You might need to change the view at the top to users. Select the user to change status for from the users tab

  3. Check the box side by side to the name(south) of the user(s) to modify the land for.

  4. On the right-hand side, under quick steps, choose Enable or Disable. In the following example, the user John Smith has a check next to their proper noun and is existence enabled for use: Enable selected user by clicking Enable on the quick steps menu

    Tip

    Enabled users are automatically switched to Enforced when they register for Azure Advertizing Multi-Factor Authentication. Don't manually change the user state to Enforced unless the user is already registered or if it is adequate for the user to experience break in connections to legacy authentication protocols.

  5. Confirm your selection in the pop-upwards window that opens.

Afterwards you lot enable users, notify them via email. Tell the users that a prompt is displayed to ask them to register the next time they sign in. Also, if your organization uses not-browser apps that don't support modern authentication, they need to create app passwords. For more information, see the Azure AD Multi-Factor Authentication end-user guide to help them get started.

Catechumen users from per-user MFA to Provisional Access based MFA

If your users were enabled using per-user enabled and enforced Azure Advertizing Multi-Factor Hallmark the following PowerShell can aid you in making the conversion to Conditional Access based Azure Advert Multi-Factor Authentication.

Run this PowerShell in an ISE window or save as a .PS1 file to run locally. The operation can simply be done by using the MSOnline module.

              # Sets the MFA requirement land office Set-MfaState {     [CmdletBinding()]     param(         [Parameter(ValueFromPipelineByPropertyName=$True)]         $ObjectId,         [Parameter(ValueFromPipelineByPropertyName=$True)]         $UserPrincipalName,         [ValidateSet("Disabled","Enabled","Enforced")]         $State     )     Process {         Write-Verbose ("Setting MFA state for user '{0}' to '{1}'." -f $ObjectId, $Land)         $Requirements = @()         if ($Country -ne "Disabled") {             $Requirement =                 [Microsoft.Online.Administration.StrongAuthenticationRequirement]::new()             $Requirement.RelyingParty = "*"             $Requirement.Land = $State             $Requirements += $Requirement         }         Set-MsolUser -ObjectId $ObjectId -UserPrincipalName $UserPrincipalName `                      -StrongAuthenticationRequirements $Requirements     } } # Disable MFA for all users Get-MsolUser -All | Gear up-MfaState -State Disabled

Side by side steps

To configure Azure Advert Multi-Cistron Authentication settings, see Configure Azure Advertisement Multi-Factor Authentication settings.

To manage user settings for Azure Advert Multi-Factor Hallmark, come across Manage user settings with Azure Ad Multi-Cistron Hallmark.

To understand why a user was prompted or non prompted to perform MFA, run across Azure Advertizing Multi-Factor Hallmark reports.