Mandatory MFA enforcement

Timelines and exceptions · All guidance changes

Entra · Official Microsoft guidanceObserved changes retained

Observed content change

The page title or its body outside the tracked passages changed. Review the source for its effect.

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

Effect uncertain

Read the current Microsoft source · Link to this observation · Compare any two versions

Observation details · observed 12 Oct 19:35 UTC

Observed by ChangeIntel: 12 Oct 19:35 UTC
Source update metadata: 6 Oct 17:42 UTC
First observed on this installation: 5 Oct 17:50 UTC
Last successful check: today 04:15 UTC
Next check due: today 10:15 UTC

Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.

This is an earlier observation; review the latest in My radar.

Timeline

From the capture of 12 Oct 19:35 UTC · an earlier observation

Every published date has passed October 2025 most recent · 12 months ago

6 dates
9 undated sections
25 with conditions
11 recorded changes

Enforcedsecond half of 2024 Enforced; the override no longer helps
EnforcedFebruary 2025 Enforced; the override no longer helps
Enforced30 Sep 2025 Now: Enforced; the override no longer helps
Enforced1 Oct 2025 Published timing is qualified; effectiveness is not confirmed.

second half of 2024 22 months agohalf windowEnforced
- Azure portalin Application IDs and URLsMilestone
- Microsoft Entra admin centerin Application IDs and URLsMilestone
- Microsoft Intune admin centerin Application IDs and URLsMilestone
October 2024 24 months agomonth window
- Phase 1 applicationsMilestoneRequirement
February 2025 20 months agomonth windowEnforced
- Phase 1 applicationsMilestoneRequirement
- Microsoft 365 admin centerin Application IDs and URLsMilestone
- FAQsMilestone
30 Sep 2025 13 months agountilEnforced
- Request more time to prepare for Phase 1 MFA enforcementMilestone
1 Oct 2025 13 months agostartingEnforced · unconfirmed
- Enforcement phasesMilestone
- Phase 2 applicationsMilestone1 condition
- Azure command-line interface (Azure CLI)in Application IDs and URLsMilestone
- Azure PowerShellin Application IDs and URLsMilestone
- Azure mobile appin Application IDs and URLsMilestone
- Infrastructure as Code (IaC) toolsin Application IDs and URLsMilestone
- REST API (Control Plane)in Application IDs and URLsMilestone
- Azure SDKin Application IDs and URLsMilestone
October 2025 12 months agomonth window
- GuidanceMilestone

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

UsernamePasswordCredential

Requirements, exceptions and scope

Phase 2 applicationsRecommendation1 passage
AccountsRequirementScopeRecommendation3 conditions3 passages
Client librariesRequirementScope9 conditions10 passages
UsernamePasswordCredential
Migrate user-based service accounts to workload identitiesRequirementScopeRecommendation1 condition2 passages
Migrate federated Identity Provider to external MFARequirementRecommendationTentative1 condition2 passages
Prepare for mandatory MFA enforcementRequirementExceptionRecommendation7 conditions3 passages
Request more time to prepare for Phase 1 MFA enforcementRecommendation1 passage
Request more time to prepare for Phase 2 MFA enforcementRequirement1 passage
FAQsRequirementExceptionScopeRecommendation10 conditions11 passages

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

How this timeline changed

Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.

6 Apr 2026
No longer on the page Migrate federated Identity Provider to external authentication methods Microsoft's source, commit 3e8b63e
6 Apr 2026
Recommendation added Migrate federated Identity Provider to external MFA Microsoft's source, commit 3e8b63e
6 Apr 2026
No longer on the page Migrate federated Identity Provider to external authentication methods Microsoft's source, commit 3e8b63e
6 Apr 2026
Requirement added Migrate federated Identity Provider to external MFA Microsoft's source, commit 3e8b63e
3 Apr 2026
No longer on the page Migrate federated Identity Provider to external authentication methods Microsoft's source, commit 84e17c5
3 Apr 2026
Recommendation added Migrate federated Identity Provider to external authentication methods Microsoft's source, commit 84e17c5
18 Mar 2026
No longer on the page Request more time to prepare for Phase 2 MFA enforcement Microsoft's source, commit 9871790
18 Mar 2026
Requirement added Request more time to prepare for Phase 2 MFA enforcement Microsoft's source, commit 9871790
28 Jan 2026
No longer on the page Request more time to prepare for Phase 2 MFA enforcement Microsoft's source, commit 45751de
28 Jan 2026
Requirement added Request more time to prepare for Phase 2 MFA enforcement Microsoft's source, commit 45751de
28 Jan 2026
Requirement added Request more time to prepare for Phase 2 MFA enforcement Microsoft's source, commit a08f69a

Observed history and review priority

Captured 12 Oct 19:35 UTC; extracted 22 Oct 18:57 UTC. Extractor: microsoft-1/9/d9863eb412f92fa5ec3a8ca32e2dd7cfe8095530f456ecb1866608d1166a435d.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 20

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

23 Oct 09:22 UTC · 60 candidates
12 Oct 19:35 UTC · 60 candidates
6 Oct 17:57 UTC · 50 candidates
6 Oct 14:47 UTC · 46 candidates
5 Oct 17:50 UTC · 50 candidates
6 Jul 16:23 UTC · 46 candidates
23 Apr 17:25 UTC · 46 candidates
6 Apr 14:46 UTC · 46 candidates
3 Apr 23:01 UTC · 46 candidates
26 Mar 22:55 UTC · 46 candidates
19 Mar 01:36 UTC · 46 candidates
18 Mar 19:58 UTC · 46 candidates
18 Mar 14:13 UTC · 46 candidates
18 Mar 13:06 UTC · 46 candidates
28 Feb 02:22 UTC · 46 candidates
28 Feb 02:05 UTC · 46 candidates
28 Jan 17:28 UTC · 46 candidates
28 Jan 00:47 UTC · 46 candidates
28 Jan 00:13 UTC · 45 candidates
27 Jan 22:54 UTC · 45 candidates

Microsoft's edits

History on GitHub

Commits to the page's source in MicrosoftDocs/entra-docs, with Microsoft's own messages. Commit dates can be hours or days before Learn publishes the change. ChangeIntel keeps a copy of each diff, so an edit stays readable here if GitHub stops serving it. Read today 00:18 UTC.

6 Oct 14:47 UTC Spelling fixes (#2125) Served on LearnView diff
6 Jul 16:23 UTC Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/entra-docs (branch main) (#13778) View diff
23 Apr 17:25 UTC Update passkey links in authentication docs View diff
6 Apr 14:46 UTC Address review feedback: fix retirement claim, update stale names, update ms.date AB#556043 View diff
3 Apr 23:01 UTC Remove stale preview tags for external MFA (now GA) View diff
26 Mar 22:55 UTC Fix broken internal links — batch 3/7 (20 files) View diff
19 Mar 01:36 UTC Add separate Phase 1 and Phase 2 MFA confirmation sections View diff
18 Mar 19:58 UTC Update concept-mandatory-multifactor-authentication.md View diff
18 Mar 14:13 UTC Remove enforcement banner text and image View diff
18 Mar 13:06 UTC Add Phase 2 mandatory MFA confirmation steps and screenshot View diff
28 Feb 02:22 UTC Restore MSAL Node link pointing to ConfidentialClientApplication View diff
28 Feb 02:05 UTC Fix broken links across 18 files View diff
28 Jan 17:28 UTC Update MFA enforcement postponement instructions View diff
28 Jan 00:47 UTC Clarify process for lifting Phase 2 MFA enforcement View diff
28 Jan 00:13 UTC Update MFA enforcement doc with new date and guidance View diff
27 Jan 22:54 UTC Merge pull request #9723 from Justinha/mfa-tenant-update View diff

4 metadata-only edits · author, dates or topic labels, no article text

12 Feb 23:16 UTC [BULK UPDATE] Moves metadata to folder level in docfx.json. Metadata onlyView diff
29 Jan 16:29 UTC Merge branch 'main' into copilot/reclassify-ms-topic-batch-3 Metadata onlyView diff
28 Jan 16:52 UTC Merge branch 'main' into copilot/reclassify-ms-topic-batch-3 Metadata onlyView diff
27 Jan 00:17 UTC Reclassify ms.topic values batch 3 (entries 81 to 120) Metadata onlyView diff

Retained observations

23 Oct 09:22 UTC
Source metadata changed; retained article content is unchanged.
12 Oct 19:35 UTC · shown above
6 Oct 17:57 UTC
1 edited passage (2 words changed), 5 removed passages (about 30 words). No rule matched the changed words; review the source for its effect.
5 Oct 17:50 UTC
Baseline for retained history; no earlier retained text to compare.

What changed

First observed 18 Oct 2026

No field changes are shown for this selection.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.