MFA & Authentication¶

Authentication Strengths¶

Authentication Strengths define a named set of allowed authentication method combinations. The CA policies CA001 and CA002 reference custom strengths rather than the basic "Require MFA" grant — this prevents weaker methods (e.g., SMS OTP) from satisfying the MFA requirement.

Entra admin center → Protection → Authentication methods → Authentication strengths → + New authentication strength

Standard MFA (for all users — CA001)¶

Allowed method combinations:

Admin MFA (for admin roles — CA002)¶

Allowed method combinations — all of Standard MFA, plus:

Authentication Methods Policy¶

Configure authentication methods at: Entra admin center → Protection → Authentication methods → Policies

Recommended Methods (enable for all users)¶

Microsoft Authenticator Settings¶

Enable passwordless phone sign-in and number matching to prevent MFA fatigue attacks:

Navigate to: Authentication methods → Microsoft Authenticator → Configure

Self-Service Password Reset (SSPR)¶

Entra admin center → Protection → Password reset

Per-User MFA Status (Legacy)¶

Avoid managing MFA via the legacy per-user portal when CA policies are in use — they conflict. Check there are no users in the Enforced state unless intentional:

Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All"

# List users without any MFA method registered
$users = Get-MgUser -All -Property Id,DisplayName,UserPrincipalName
foreach ($user in $users) {
    $methods = Get-MgUserAuthenticationMethod -UserId $user.Id
    if ($methods.Count -le 1) {  # Only "Password" method
        Write-Output "$($user.DisplayName) | $($user.UserPrincipalName) — NO MFA registered"
    }
}

Temporary Access Pass (TAP)¶

Use TAP for new user onboarding and for recovering locked-out accounts.

Entra admin center → Protection → Authentication methods → Temporary Access Pass

Generating a TAP for a user¶

Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All"

$tapBody = @{
    startDateTime    = (Get-Date).ToUniversalTime().ToString("o")
    lifetimeInMinutes = 60
    isUsableOnce     = $true
}

New-MgUserAuthenticationTemporaryAccessPassMethod -UserId "user@domain.com" -BodyParameter $tapBody

Password Protection¶

Entra admin center → Protection → Authentication methods → Password protection

Admin Account Best Practices¶

• Dedicated cloud-only admin accounts (e.g., admin.jsmith@domain.com) — no email licence
• Admin accounts not used for day-to-day email/productivity tasks
• All admin accounts have MFA registered (FIDO2 preferred)
• Use Privileged Identity Management (PIM) for just-in-time access to Global Admin
• Minimum 2, maximum 4 Global Administrators