Microsoft 365 admin center multifactor authentication enforcement
Versions captured by this deployment. Earlier versions and notices may be missing; first observed is not first published.
Rollout
- Ends
- 9 Dec 2026
Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".
- Microsoft's start date
- 8 Jan 2026
- Last changed by Microsoft
- 8 Jan 2026
- First seen here
- 19 Oct 2026
- Versions seen
- 1
What the notice says
Microsoft's text, with its sections, lists and tables; source markup removedIf you have already set up multi-factor authentication, thank you. No further action is needed at this time. If you have not, please read on.
As part of our ongoing commitment to advancing cybersecurity across our company and products, last year, starting February 2025, Microsoft began requiring all users to use multi-factor authentication (MFA) when signing into the Microsoft 365 admin center. Starting February 9th 2026, Microsoft will continue to ramp up enforcement, and users will be unable to sign in to the Microsoft 365 admin center without successfully completing MFA.
Implementing MFA in the Microsoft 365 admin center significantly reduces the risk of account compromise, prevents unauthorized access, and safeguards sensitive data. By adding an extra layer of protection beyond standard username and password authentication, MFA makes it harder for attackers to steal data and prevents unauthorized access from phishing, credential stuffing, brute force, or password reuse attacks.
Take action now
Global admins: To set up MFA in your organization now, visit the MFA setup guide at aka.ms/MFAWizard or refer to Set up multifactor authentication for Microsoft 365
Users accessing the Microsoft 365 admin center: Check your verification methods and add one if needed by going to aka.ms/mfasetup.
How this will affect your organization
MFA will need to be enabled for your tenant to ensure admins are able to sign-in to the Microsoft 365 admin center. Note that the following Microsoft 365 admin center URLs are impacted by this change:
- https://portal.office.com/adminportal/home
- https://admin.cloud.microsoft
- https://admin.microsoft.com
What to do to prepare
- If you have not already, set up MFA as soon as possible to avoid sign-in issues once mandatory MFA enforcement is rolled out to your organization.
- If you have already set up MFA, no action is required. It is recommended that you verify that all users accessing the Microsoft 365 admin center have added a verification method to their account (such as a Microsoft Authenticator).
- Global admins: To set up MFA in your organization now, visit the MFA setup guide at aka.ms/MFAWizard or refer to Set up multifactor authentication for Microsoft 365.
- Users accessing the Microsoft 365 admin center: Check your verification methods and add one if needed by going to aka.ms/mfasetup.
For more information, refer to the FAQs in the blog post here.
Additional info URL (i.e., link to relevant support doc):
Multifactor authentication for Microsoft 365 - Microsoft 365 admin | Microsoft Learn
Set up multifactor authentication for users - Microsoft 365 admin | Microsoft Learn
- Microsoft began requiring all users to use multi-factor authentication (MFA)
- Microsoft 365 admin center
- aka.ms/MFAWizard
- Set up multifactor authentication for Microsoft 365
- aka.ms/mfasetup
- here
- https://aka.ms/mfasetup
- Multifactor authentication for Microsoft 365 - Microsoft 365 admin | Microsoft Learn
- Set up multifactor authentication for users - Microsoft 365 admin | Microsoft Learn
What changed
Between the versions this installation saw, newest firstThis installation has seen one version of this notice, first on 19 Oct 2026. Later changes will show here.
Linked documentation
Microsoft pages the notice links toNot confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
- Versions before 19 Oct 2026: this installation first saw the notice after Microsoft posted it.
- 1 linked page has not been read yet.