'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Difference Between Enabled and Enforced MFA in Microsoft 365
Question details
The user wants to understand the distinction between 'Enabled' and 'Enforced' Multi-Factor Authentication (MFA) statuses and why enforcement options vary among users.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- An administrator is attempting to configure and enforce per-user MFA for all employees in a Microsoft 365 organization.
- Observed behavior
- Users show up with different MFA statuses (Enabled vs. Enforced), and administrators cannot consistently apply the 'Enforced' status to all users despite similar configurations.
Ensure you are signed in to the Microsoft Entra admin center with Global Administrator or Authentication Administrator privileges.
Understand and Configure Per-User MFA Statuses
Clarify the differences between MFA states and check policies that might block manual enforcement.
The 'Enabled' status means the user is enrolled in per-user MFA. They will be prompted to register for MFA upon their next sign-in, but it does not strictly mandate immediate MFA use in all conditions. The 'Enforced' status means the user has completed registration and is strictly required to use MFA during authentication.
Discrepancies where you cannot enforce MFA for specific users usually occur because organization-wide Security Defaults or Conditional Access policies override manual per-user settings.
Log in to the Microsoft Entra admin center using your administrator credentials.
Navigate to Identity > Users > All users in the left-hand menu.
Click on the 'Per-user MFA' option located at the top of the user list page to open the multifactor authentication portal.
Locate the affected users and check their current status. Select a user and click 'Enforce' or 'Enable' on the right-hand action pane to update their state.
Streamline Your Workflow with WPS Office
While you configure your organization's Microsoft 365 security settings, consider WPS Office as a lightweight, free, and highly compatible alternative for your daily document productivity needs.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer and follow the on-screen prompts to set up the software in minutes.
- 3. Open Your Documents: Launch WPS Office and open your existing Microsoft Office files seamlessly without losing formatting.
Frequently Asked Questions
Why is the option to 'Enforce' MFA grayed out for some users?
This typically happens if Security Defaults or specific Conditional Access policies are active in your tenant. These modern security features take precedence over legacy per-user MFA settings, preventing manual enforcement.
What happens immediately after changing a user from Enabled to Enforced?
Once a user is set to Enforced, they will be prompted to complete their MFA setup (if they haven't already) during their next sign-in attempt, and they will not be able to access their account until the setup is finalized.
Should I use per-user MFA or Conditional Access?
Conditional Access is the recommended approach. Legacy per-user MFA applies a blanket requirement for all sign-ins, whereas Conditional Access allows administrators to create granular policies based on location, device state, and risk level.
Does enabling MFA log users out of their current sessions?
No, changing a user's MFA status to Enabled or Enforced does not immediately drop active sessions. The MFA prompt will appear during their next required authentication or when their current session token expires.
