MC1143999 – (Updated) Azure Information Protection: Enable multifactor authentication for your Azure tenant by October 1, 2025

Product:

Entra, Purview Information Protection

Platform:

mobile, Online, World tenant

Status:

Change type:

Admin impact, Updated message, User impact

Links:

Details:

Summary:
Microsoft will enforce multifactor authentication (MFA) for all Azure resource management actions starting October 1, 2025, with a postponement option until July 2026. Users must enable MFA, update Azure CLI/PowerShell, and can apply Azure Policy to assess impact. Gallatin customers are advised to implement MFA without enforcement.

Details:
Updated September 5, 2025: Gallatin customers are advised to still implement multifactor authentication for user accounts to improve security, but there will not be Microsoft enforcement at this time.
Introduction
To strengthen security across Azure environments, Microsoft is introducing enforcement of multifactor authentication (MFA) for all Azure resource management actions. This change helps protect your organization from unauthorized access and aligns with industry best practices for identity protection.
This effort is part of Microsoft's commitment to enhance security for all customers and follows Azure's Phase 1 rollout completed last year. Phase 2 enforcement ensures that all Azure clients - including CLI, PowerShell, SDKs, and REST APIs - are protected against unauthorized access.
When this will happen
Phase 2 enforcement will begin rolling out on October 1, 2025, and will be applied gradually across tenants. Customers may postpone enforcement until July 2026 if additional time is needed to become compliant.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2025-08-29

updated:
2025-09-06

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

MFA Implementation
Users may face access issues if MFA is not set up before the enforcement date, leading to inability to perform Azure resource management actions.
   - roles: Azure Administrators, End Users
   - references: https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet#phase-1-applications, https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/mfa-enforcement

Automation Breakage
Scripts and automation relying on user identities may fail if MFA is not configured, disrupting automated processes.
   - roles: DevOps Engineers, System Administrators
   - references: https://learn.microsoft.com/entra/identity/authentication/how-to-mandatory-multifactor-authentication, https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/mfa-enforcement

User Experience Degradation
Users unprepared for MFA may experience frustration and delays in accessing Azure resources, impacting productivity.
   - roles: End Users, Support Staff
   - references: https://learn.microsoft.com/entra/identity/authentication/concept-mfa-howitworks, https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet#request-more-time-to-prepare-for-enforcement" target="_blank" rel="nofollow noopener noreferrer">https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet#request-more-time-to-prepare-for-enforcement

Compliance Risks
Failure to implement MFA may lead to compliance issues, especially for organizations handling sensitive data, risking data breaches.
   - roles: Compliance Officers, Security Officers
   - references: https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet#request-more-time-to-prepare-for-enforcement" target="_blank" rel="nofollow noopener noreferrer">https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet#request-more-time-to-prepare-for-enforcement, https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/mfa-enforcement

Increased Support Tickets
A surge in support requests may occur as users struggle with MFA setup, overwhelming IT support resources.
   - roles: Help Desk Technicians, IT Support Managers
   - references: https://learn.microsoft.com/entra/identity/authentication/how-to-verify-that-users-are-set-up-for-mandatory-mfa, https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet#request-more-time-to-prepare-for-enforcement" target="_blank" rel="nofollow noopener noreferrer">https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet#request-more-time-to-prepare-for-enforcement

Configutation Options**

XXXXXXX ... paid membership only

Opportunities**

XXXXXXX ... free basic plan only

Potentional Risks**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Microsoft is implementing a new security measure for Azure, requiring multifactor authentication (MFA) for all actions related to managing Azure resources. Think of MFA like adding a second lock to your front door. Just as you wouldn't rely solely on a single lock to protect your home, MFA adds an extra layer of security to your digital environment. It requires users to verify their identity in two different ways before accessing Azure resources, making it much harder for unauthorized individuals to gain access.

Starting October 1, 2025, this security measure will be gradually enforced, with an option to delay until July 2026 if more time is needed. This change affects everyone using Azure, whether they're accessing it through the web, command-line tools, or automated scripts. For those familiar with updating software, it's similar to ensuring your computer's operating system is up-to-date. Users will need to ensure they have the latest versions of Azure CLI and PowerShell to maintain compatibility and security.

For organizations that need more time to comply, there's an option to postpone the enforcement. This is akin to requesting an extension on a deadline to ensure everything is in place. It's important to verify that all users are set up for MFA, which can be checked using Azure Policy. This is like doing a safety drill to ensure everyone knows what to do in case of an emergency.

No immediate action is required unless your organization plans to delay the enforcement. This change is part of a broader effort to enhance security and protect sensitive information, much like upgrading security systems in a building to prevent unauthorized entry. For more detailed guidance, Microsoft provides resources to help understand and implement these changes effectively.