How to Enable MFA Automatically for New Azure AD Users
Question details
The user needs to know how to ensure new Azure Active Directory (Microsoft Entra ID) users have Multi-Factor Authentication (MFA) enabled automatically upon account creation.
- Product
- Azure Active Directory (Microsoft Entra ID)
- Device & OS
- not provided
- Scenario
- Creating new user accounts in an organization's cloud identity environment and ensuring they are secured with MFA from their very first login.
- Observed behavior
- By default, the legacy per-user MFA setting remains in a 'Disabled' state for newly created users until an administrator manually changes it or the user undergoes enrollment.
Ensure you are signed into the Microsoft Entra admin center with an account that has at least the Conditional Access Administrator or Security Administrator role to modify organization-wide authentication policies.
Configure an Organization-Wide Conditional Access Policy
The recommended approach to automatically enforcing MFA for all new and existing users is by deploying a Conditional Access policy, which overrides legacy per-user MFA states.
Microsoft strongly recommends moving away from legacy per-user MFA states (Enabled/Enforced) and instead using Conditional Access policies. This ensures that any user who falls under the policy scope is automatically prompted to register for and use MFA, scaling perfectly as new users are added.
Sign in to the Microsoft Entra admin center, expand the 'Protection' menu on the left sidebar, and click on 'Conditional Access'.
Click 'Create new policy' at the top of the page. Name the policy descriptively, such as 'Require MFA for All Users'.
Under 'Assignments', click 'Users'. Choose 'All users'. Be sure to utilize the 'Exclude' tab to omit your emergency access (break-glass) administrator accounts to prevent locking yourself out of the tenant.
Under 'Target resources', select 'Cloud apps', and choose 'All cloud apps' to ensure the policy applies to every service authenticating via Entra ID.
Scroll down to 'Access controls', click 'Grant', select 'Require multifactor authentication', and click 'Select'.
Set the 'Enable policy' toggle at the bottom to 'On', then click the 'Create' button to apply the enforcement.
Enable Microsoft Entra Security Defaults
If your organization does not have the Microsoft Entra ID P1 or P2 licenses required for Conditional Access, you can use Security Defaults to automatically protect all accounts with MFA.
Enhance Your Daily Productivity with WPS Office
While you secure your organization's identities with Entra ID and MFA, consider equipping your team with a cost-effective, lightweight, and highly compatible office suite. WPS Office provides excellent performance and seamless integration with mainstream document workflows without the heavy licensing costs.
- 1. Visit the Official Website: Navigate to the official WPS Office website on your computer.
- 2. Download the Installer: Click the 'Free Download' button to get the installer that matches your operating system.
- 3. Install and Run: Run the downloaded file and follow the standard installation prompts to start using WPS Office immediately.
Frequently Asked Questions
Can I script per-user MFA enforcement for new users using PowerShell?
Yes, you can use the Microsoft Graph PowerShell module to update a user's strong authentication requirements immediately after creating them. However, Microsoft strongly recommends using Conditional Access instead of scripting legacy per-user MFA states, as policy-based enforcement is more robust and easier to manage.
What happens to a user's per-user MFA state when a Conditional Access policy is applied?
When a Conditional Access policy enforces MFA, the traditional per-user MFA state in the portal may still display as 'Disabled'. This is normal; the Conditional Access policy overrides the per-user setting and actively enforces MFA prompts during sign-in.
How do I track which new users have successfully registered for MFA?
You can monitor MFA registration status centrally by navigating to Microsoft Entra ID > Protection > Authentication Methods > Activity. From here, you can view user registration details, see which methods they have configured, and generate compliance reports.
Do Security Defaults apply to newly created users immediately?
Yes. Once Security Defaults are active, all users (including newly created ones) are prompted to register for MFA using the Microsoft Authenticator app. They are given a 14-day grace period from their first login to complete registration, after which it becomes strictly enforced.
