Mandatory MFA enforcement

Source history: extracted from the page's source file at a commit; shared includes are not expanded

1. Enforcedsecond half of 2024 Enforced; the override no longer helps
2. EnforcedFebruary 2025 Enforced; the override no longer helps
3. Enforced30 Sep 2025 Now: Enforced; the override no longer helps
4. Enforced1 Oct 2025 Published timing is qualified; effectiveness is not confirmed.

1. second half of 2024 21 months agohalf windowEnforced
   • Azure portalin Application IDs and URLsMilestone
   • Microsoft Entra admin centerin Application IDs and URLsMilestone
   • Microsoft Intune admin centerin Application IDs and URLsMilestone
2. October 2024 23 months agomonth window
   • Phase 1 applicationsMilestoneRequirement
3. February 2025 19 months agomonth windowEnforced
   • Phase 1 applicationsMilestoneRequirement
   • Microsoft 365 admin centerin Application IDs and URLsMilestone
4. 30 Sep 2025 12 months agountilEnforced
   • Request more time to prepare for Phase 1 MFA enforcementMilestone
5. 1 Oct 2025 12 months agostartingEnforced · unconfirmed
   • Enforcement phasesMilestone
   • Phase 2 applicationsMilestone1 condition
   • Azure command-line interface (Azure CLI)in Application IDs and URLsMilestone
   • Azure PowerShellin Application IDs and URLsMilestone
   • Azure mobile appin Application IDs and URLsMilestone
   • Infrastructure as Code (IaC) toolsin Application IDs and URLsMilestone
   • REST API (Control Plane)in Application IDs and URLsMilestone
   • Azure SDKin Application IDs and URLsMilestone

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• UsernamePasswordCredential

Requirements, exceptions and scope

• Phase 2 applicationsRecommendation1 passage
• AccountsRequirementScopeRecommendation3 conditions3 passages
• .NETRequirement2 conditions2 passages
• GoRequirement2 conditions2 passages
• JavaRequirement2 conditions2 passages
• Node.jsRequirement2 conditions2 passages
• PythonRequirementScope2 conditions3 passages
  UsernamePasswordCredential
• Migrate user-based service accounts to workload identitiesRequirementScopeRecommendation1 condition2 passages
• Migrate federated Identity Provider to external authentication methodsRequirementRecommendationTentative1 condition2 passages
• Prepare for mandatory MFA enforcementRequirementExceptionRecommendation7 conditions3 passages
• Request more time to prepare for Phase 1 MFA enforcementRecommendation1 passage
• FAQsRequirement1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.