Microsoft Azure to Require MFA Starting July 2024

Microsoft Azure will mandate the use of multi-factor authentication (MFA) for all users beginning in July of 2024, as part of its Secure Future Initiative.

The aim is to enhance security on the cloud computing platform and prevent unauthorized access, with the initial rollout targeting Azure admins, extending to PowerShell and Terraform users, while excluding Azure-hosted apps, websites, and services. End users will be impacted only if they access the Azure portal or use PowerShell and Terraform to manage resources.

MFA is a critical security measure for identity and access management, requiring multiple forms of identification, such as passwords, PINs, phone authentication, tokens, fingerprints, or facial recognition. The added security layer provided by MFA helps block phishing and brute-force attacks, significantly reducing the risk of data breaches.

Microsoft Entra ID (previously known as Azure Active Directory) will offer various MFA options, including Microsoft Authenticator, SMS, voice calls, and hardware tokens, allowing admins to customize settings based on user signals like location, device, role, or risk level.

Microsoft says 99.9 percent of compromised accounts did not use MFA, while MFA has prevented 99.2 percent of attacks. With the rise of remote work, MFA can provide a critical layer of protection against unauthorized access from unknown or suspicious sources.

The Secure Future Initiative also aims to help organizations comply with security standards such as PCI DSS, HIPAA, GDPR, and NIST. Microsoft encourages users to enable free MFA at the tenant level using the MFA wizard in Microsoft Entra.

Source: Spiceworks

—

May 23, 2024 — by Ali Nassar-Smith