How to Require MFA When Users Activate Microsoft Entra Roles
Question details
The user wants to enforce Multi-Factor Authentication (MFA) specifically when administrators activate their privileged roles, rather than just during the initial sign-in process.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Activating administrative roles within the Microsoft Entra portal.
- Observed behavior
- Conditional Access prompts for MFA at sign-in, but it fails to prompt for secondary verification when a user dynamically activates an administrative role.
Ensure you have an active Microsoft Entra ID Premium P2 license, as Privileged Identity Management (PIM) is required to enforce activation-time controls. You must also have the Global Administrator or Privileged Role Administrator role to modify these settings.
Configure MFA for Role Activation via Microsoft Entra PIM
Use Microsoft Entra Privileged Identity Management (PIM) to make roles eligible and explicitly enforce an MFA challenge during the just-in-time role activation process.
Conditional Access evaluates sign-in risk at the start of a session but cannot natively force an MFA prompt at the exact moment an administrative role is activated. Microsoft Entra PIM bridges this gap by offering just-in-time (JIT) access policies and customizable role activation requirements.
Log in to the Microsoft Entra admin center or Azure portal using an account with Privileged Role Administrator permissions, then navigate to 'Identity' > 'Roles & admins' > 'Privileged Identity Management'.
Under the 'Manage' section on the left sidebar, select 'Microsoft Entra roles'. Then, click on 'Roles' to view the list of available administrative roles.
Select the specific administrative role you wish to protect (e.g., Global Administrator). Click the 'Settings' gear icon at the top of the page, and then click 'Edit' to modify the activation requirements.
Under the 'Activation' tab, check the box labeled 'On activation, require Microsoft Entra multifactor authentication'. Configure any additional required settings like justification or ticket information, then click 'Update' to save the policy.
Use Conditional Access to Protect Highly Privileged Roles at Sign-In
While it does not prompt right at the moment of activation, Conditional Access provides foundational protection by strictly enforcing MFA upon sign-in for users assigned to privileged roles.
Enhance IT Productivity with WPS Office
While configuring robust security controls in Microsoft Entra, streamline your IT documentation and daily administrative workflows with WPS Office. It provides a lightweight, highly compatible alternative to Microsoft Office that is cost-effective and easy to deploy across your organization.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install the Software: Run the setup file and follow the on-screen instructions to complete the installation in seconds.
- 3. Edit Your Documents: Launch WPS Office to securely open, edit, and save your existing Microsoft Office documents without formatting loss.
Frequently Asked Questions
Why isn't Conditional Access prompting for MFA when I activate a Microsoft Entra role?
Conditional Access primarily evaluates the requirement for MFA at the time of initial sign-in or when accessing specific cloud applications. It does not trigger when an eligible Microsoft Entra role is dynamically activated during an active session. To enforce MFA specifically upon role activation, you must configure Microsoft Entra Privileged Identity Management (PIM).
Do I need a specific license to use Privileged Identity Management (PIM)?
Yes, utilizing Microsoft Entra PIM requires a Microsoft Entra ID Premium P2 or Microsoft Entra ID Governance license. Without this tier, you cannot configure eligible role assignments, set up justification requirements, or enforce activation-time MFA challenges.
Can I require an approval workflow in addition to MFA for role activation?
Yes. Within the PIM role activation settings, you can check 'Require approval to activate this role' alongside the MFA requirement. You must then designate specific approvers who will review and authorize the activation request after the user completes their MFA prompt.
What is the difference between an 'Eligible' and an 'Active' role assignment in PIM?
An 'Active' assignment grants the user the role permissions immediately and continuously without requiring further action. An 'Eligible' assignment means the user holds the potential to use the role but must proactively activate it when needed. This activation process is where you can enforce just-in-time security controls like MFA, ticketing requirements, and maximum duration limits.
