Mandatory MFA enforcement
Retained observation
Source metadata changed; retained article content is unchanged.
Read the current Microsoft source · Link to this observation · Compare any two versions
Observation details · observed 23 Oct 09:22 UTC
- Observed by ChangeIntel
- 23 Oct 09:22 UTC
- Source update metadata
- 6 Oct 17:42 UTC
- First observed on this installation
- 5 Oct 17:50 UTC
- Last successful check
- today 04:15 UTC
- Next check due
- today 10:15 UTC
Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.
Watch this page to review its changes in My radar.
Timeline
From the capture of 23 Oct 09:22 UTC- 6 dates
- 9 undated sections
- 25 with conditions
- 11 recorded changes
- Enforcedsecond half of 2024 Enforced; the override no longer helps
- EnforcedFebruary 2025 Enforced; the override no longer helps
- Enforced30 Sep 2025 Now: Enforced; the override no longer helps
- Enforced1 Oct 2025 Published timing is qualified; effectiveness is not confirmed.
- 22 months agohalf windowEnforced
- 24 months agomonth window
- 20 months agomonth windowEnforced
- FAQsMilestone
- 13 months agountilEnforced
- 13 months agostartingEnforced · unconfirmed
- Enforcement phasesMilestone
- 12 months agomonth window
- GuidanceMilestone
That's why, starting in 2024, we'll enforce mandatory MFA for all Azure sign-in attempts. For more background about this requirement, see our blog posts Azure…
Settings and overrides named on this page
Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.
UsernamePasswordCredential
Requirements, exceptions and scope
UsernamePasswordCredential- Migrate user-based service accounts to workload identitiesRequirementScopeRecommendation1 condition2 passages
- Migrate federated Identity Provider to external MFARequirementRecommendationTentative1 condition2 passages
Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.
How this timeline changed
Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.
Observed history and review priority
Captured 23 Oct 09:22 UTC; extracted 23 Oct 09:22 UTC. Extractor: microsoft-1/9/d9863eb412f92fa5ec3a8ca32e2dd7cfe8095530f456ecb1866608d1166a435d.
Review priority. Previously extracted guidance is missing from a later capture · Extracted assertions require review · Publisher marks guidance tentative · Applicability or exceptions require review
0 date changes and 0 condition changes across 2 compared revisions. Suggested check interval: 6 hours.
Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.
Retained observations · 20
Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.
- 23 Oct 09:22 UTC · 60 candidates
- 12 Oct 19:35 UTC · 60 candidates
- 6 Oct 17:57 UTC · 50 candidates
- 6 Oct 14:47 UTC · 46 candidates
- 5 Oct 17:50 UTC · 50 candidates
- 6 Jul 16:23 UTC · 46 candidates
- 23 Apr 17:25 UTC · 46 candidates
- 6 Apr 14:46 UTC · 46 candidates
- 3 Apr 23:01 UTC · 46 candidates
- 26 Mar 22:55 UTC · 46 candidates
- 19 Mar 01:36 UTC · 46 candidates
- 18 Mar 19:58 UTC · 46 candidates
- 18 Mar 14:13 UTC · 46 candidates
- 18 Mar 13:06 UTC · 46 candidates
- 28 Feb 02:22 UTC · 46 candidates
- 28 Feb 02:05 UTC · 46 candidates
- 28 Jan 17:28 UTC · 46 candidates
- 28 Jan 00:47 UTC · 46 candidates
- 28 Jan 00:13 UTC · 45 candidates
- 27 Jan 22:54 UTC · 45 candidates
Microsoft's edits
History on GitHubCommits to the page's source in MicrosoftDocs/entra-docs, with Microsoft's own messages. Commit dates can be hours or days before Learn publishes the change. ChangeIntel keeps a copy of each diff, so an edit stays readable here if GitHub stops serving it. Read today 00:18 UTC.
Related public evidence
- Official documentation · 13 Oct 2026Combined security information registration
- Public source · 13 Oct 2026MC1450134: (Updated) Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors
- Official documentation · 12 Oct 2026Authentication registration campaigns
- Official documentation · 12 Oct 2026Conditional Access authentication strengths for guests
- Official documentation · 12 Oct 2026MFA NPS extension
- Official documentation · 12 Oct 2026Authentication methods policy
Retained observations
- 23 Oct 09:22 UTC · shown above
- 12 Oct 19:35 UTC
The page title or its body outside the tracked passages changed. Review the source for its effect.
- 6 Oct 17:57 UTC
1 edited passage (2 words changed), 5 removed passages (about 30 words). No rule matched the changed words; review the source for its effect.
- 5 Oct 17:50 UTC
Baseline for retained history; no earlier retained text to compare.
What changed
First observed 18 Oct 2026No field changes are shown for this selection.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.