Require MFA authentication strength
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit ebb1b98 · +6 −32 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.service: entra-id
66
ms.subservice: conditional-access
77
ms.topic: how-to
8
−ms.date: 09/27/2024
8
+ms.date: 02/03/2025
99
1010
ms.author: joflore
1111
author: MicrosoftGuyJFlo
⋯ 39 unchanged lines
5151
1. Under **Exclude** select **Users and groups** and choose your organization's emergency access or break-glass accounts.
5252
1. You might choose to exclude your guest users if you're targeting them with a [guest user specific policy](policy-guests-mfa-strength.md).
5353
1. Under **Target resources** > **Resources (formerly cloud apps)** > **Include**, select **All resources (formerly 'All cloud apps')**.
54
− 1. Under **Exclude**, select any applications that don't require multifactor authentication.
54
+
55
+ > [!TIP]
56
+ > Microsoft recommends all organizations create a baseline Conditional Access policy that targets: All users, all resources, and requires multifactor authentication.
57
+
5558
1. Under **Access controls** > **Grant**, select **Grant access**.
5659
1. Select **Require authentication strength**, then select the built-in **Multifactor authentication strength** from the list.
5760
1. Select **Select**.
⋯ 14 unchanged lines
7275
1. Exclude **All trusted networks and locations**.
7376
1. **Save** your policy changes.
7477
75
−## Application exclusions
76
−
77
−Organizations might have many cloud applications in use. Not all of those applications require equal security. For example, the payroll and attendance applications might require MFA but the cafeteria probably doesn't. Administrators can choose to exclude specific applications from their policy.
78
−
79
−### Subscription activation
80
−
81
−Organizations that use the Subscription Activation feature to enable users to "step-up" from one version of Windows to another and use Conditional Access policies to control access need to exclude one of the following cloud apps from their Conditional Access policies using **Select Excluded Cloud Apps**:
82
−
83
−- [Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications).
84
−
85
−- [Windows Store for Business, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications).
86
−
87
−Although the app ID is the same in both instances, the name of the cloud app depends on the tenant.
88
−
89
−<!-- 8605089 -->
90
−
91
−When a device is offline for an extended period of time, it might not reactivate automatically if this Conditional Access exclusion isn't in place. Setting this Conditional Access exclusion ensures that Subscription Activation continues to work seamlessly.
92
−
93
−Starting with Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later, users are prompted for authentication with a toast notification when Subscription Activation needs to reactivate. The toast notification shows the following message:
94
−
95
−> **Your account requires authentication**
96
−>
97
−> **Please sign in to your work or school account to verify your information.**
98
−
99
−Additionally, in the [**Activation**](ms-settings:activation) pane, the following message might appear:
100
−
101
−> **Please sign in to your work or school account to verify your information.**
102
−
103
−The prompt for authentication usually occurs when a device is offline for an extended period of time. This change eliminates the need for an exclusion in the Conditional Access policy for Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later. A Conditional Access policy can still be used with Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later if the prompt for user authentication via a toast notification isn't desired.
104
−
10578
## Related content
10679
10780
- [Conditional Access templates](concept-conditional-access-policy-common.md)
10881
- [Use report-only mode for Conditional Access to determine the results of new policy decisions.](concept-conditional-access-report-only.md)
82
+- [Windows subscription activation](/windows/deployment/windows-subscription-activation#adding-conditional-access-policy)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.