You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Per-user Multi-Factor Authentication - Azure Active Directory
3
-
description: Enable MFA by changing user states in Azure Multi-Factor Authentication.
2
+
title: Enable per-user Multi-Factor Authentication - Azure Active Directory
3
+
description: Learn how to enable per-user Azure Multi-Factor Authentication by changing the user state
4
4
5
5
services: multi-factor-authentication
6
6
ms.service: active-directory
7
7
ms.subservice: authentication
8
8
ms.topic: how-to
9
-
ms.date: 11/21/2019
9
+
ms.date: 04/13/2020
10
10
11
11
ms.author: iainfou
12
12
author: iainfoulds
@@ -15,111 +15,106 @@ ms.reviewer: michmcla
15
15
16
16
ms.collection: M365-identity-device-management
17
17
---
18
-
# How to require two-step verification for a user
18
+
# Enable per-user Azure Multi-Factor Authentication to secure sign-in events
19
19
20
-
You can take one of two approaches for requiring two-step verification, both of which require using a global administrator account. The first option is to enable each user for Azure Multi-Factor Authentication (MFA). When users are enabled individually, they perform two-step verification each time they sign in (with some exceptions, such as when they sign in from trusted IP addresses or when the _remembered devices_ feature is turned on). The second option is to set up a Conditional Access policy that requires two-step verification under certain conditions.
20
+
There are two ways to secure user sign-in events by requiring multi-factor authentication in Azure AD. The first, and preferred, option is to set up a Conditional Access policy that requires multi-factor authentication under certain conditions. The second option is to enable each user for Azure Multi-Factor Authentication. When users are enabled individually, they perform multi-factor authentication each time they sign in (with some exceptions, such as when they sign in from trusted IP addresses or when the _remembered devices_ feature is turned on).
21
21
22
-
> [!TIP]
23
-
> Enabling Azure Multi-Factor Authentication using Conditional Access policies is the recommended approach. Changing user states is no longer recommended unless your licenses do not include Conditional Access as it will require users to perform MFA every time they sign in.
24
-
25
-
## Choose how to enable
26
-
27
-
**Enabled by changing user state** - This is the traditional method for requiring two-step verification and is discussed in this article. It works with both Azure MFA in the cloud and Azure MFA Server. Using this method requires users to perform two-step verification **every time** they sign in and overrides Conditional Access policies.
28
-
29
-
**Enabled by Conditional Access policy** - This is the most flexible means to enable two-step verification for your users. Enabling using Conditional Access policy only works for Azure MFA in the cloud and is a premium feature of Azure AD. More information on this method can be found in [Deploy cloud-based Azure Multi-Factor Authentication](howto-mfa-getstarted.md).
30
-
31
-
**Enabled by Azure AD Identity Protection** - This method uses the Azure AD Identity Protection risk policy to require two-step verification based only on sign-in risk for all cloud applications. This method requires Azure Active Directory P2 licensing. More information on this method can be found in [Azure Active Directory Identity Protection](../identity-protection/howto-sign-in-risk-policy.md)
32
-
33
-
> [!Note]
34
-
> More information about licenses and pricing can be found on the [Azure AD](https://azure.microsoft.com/pricing/details/active-directory/
35
-
) and [Multi-Factor Authentication](https://azure.microsoft.com/pricing/details/multi-factor-authentication/) pricing pages.
22
+
> [!NOTE]
23
+
> Enabling Azure Multi-Factor Authentication using Conditional Access policies is the recommended approach. Changing user states is no longer recommended unless your licenses don't include Conditional Access as it requires users to perform MFA every time they sign in.
24
+
>
25
+
> To get started using Conditional Access, see [Tutorial: Secure user sign-in events with Azure Multi-Factor Authentication](tutorial-enable-azure-mfa.md).
36
26
37
-
## Enable Azure MFA by changing user state
27
+
## Azure Multi-Factor Authentication user states
38
28
39
29
User accounts in Azure Multi-Factor Authentication have the following three distinct states:
40
30
41
31
> [!IMPORTANT]
42
-
> Enabling Azure MFA through a Conditional Access policy will not change the state of the user. Do not be alarmed users appear disabled. Conditional Access does not change the state. **Organizations should not enable or enforce users if they are utilizing Conditional Access policies.**
32
+
> Enabling Azure Multi-Factor Authentication through a Conditional Access policy doesn't change the state of the user. Don't be alarmed if users appear disabled. Conditional Access doesn't change the state.
33
+
>
34
+
> **You shouldn't enable or enforce users if you're using Conditional Access policies.**
43
35
44
36
| Status | Description | Non-browser apps affected | Browser apps affected | Modern authentication affected |
45
37
|:---:| --- |:---:|:--:|:--:|
46
-
| Disabled | The default state for a new user not enrolled in Azure MFA. | No | No | No |
47
-
| Enabled | The user has been enrolled in Azure MFA, but has not registered. They receive a prompt to register the next time they sign in. | No. They continue to work until the registration process is completed. | Yes. After the session expires, Azure MFA registration is required.| Yes. After the access token expires, Azure MFA registration is required. |
48
-
| Enforced | The user has been enrolled and has completed the registration process for Azure MFA. | Yes. Apps require app passwords. | Yes. Azure MFA is required at login. | Yes. Azure MFA is required at login. |
38
+
| Disabled | The default state for a new user not enrolled in Azure Multi-Factor Authentication. | No | No | No |
39
+
| Enabled | The user has been enrolled in Azure Multi-Factor Authentication, but hasn't registered. They receive a prompt to register the next time they sign in. | No. They continue to work until the registration process is completed. | Yes. After the session expires, Azure Multi-Factor Authentication registration is required.| Yes. After the access token expires, Azure Multi-Factor Authentication registration is required. |
40
+
| Enforced | The user has been enrolled and has completed the registration process for Azure Multi-Factor Authentication. | Yes. Apps require app passwords. | Yes. Azure Multi-Factor Authentication is required at login. | Yes. Azure Multi-Factor Authentication is required at login. |
49
41
50
-
A user's state reflects whether an admin has enrolled them in Azure MFA, and whether they completed the registration process.
42
+
A user's state reflects whether an admin has enrolled them in Azure Multi-Factor Authentication, and whether they completed the registration process.
51
43
52
-
All users start out *Disabled*. When you enroll users in Azure MFA, their state changes to *Enabled*. When enabled users sign in and complete the registration process, their state changes to *Enforced*.
44
+
All users start out *Disabled*. When you enroll users in Azure Multi-Factor Authentication, their state changes to *Enabled*. When enabled users sign in and complete the registration process, their state changes to *Enforced*.
53
45
54
46
> [!NOTE]
55
47
> If MFA is re-enabled on a user object that already has registration details, such as phone or email, then administrators need to have that user re-register MFA via Azure portal or PowerShell. If the user doesn't re-register, their MFA state doesn't transition from *Enabled* to *Enforced* in MFA management UI.
56
48
57
-
###View the status for a user
49
+
## View the status for a user
58
50
59
-
Use the following steps to access the page where you can view and manage user states:
51
+
Use the following steps to access the Azure portal page where you can view and manage user states:
60
52
61
53
1. Sign in to the [Azure portal](https://portal.azure.com) as an administrator.
62
-
2. Search for and select *Azure Active Directory*. Select**Users** > **All users**.
63
-
3. Select **Multi-Factor Authentication**. You may need to scroll to the right to see this menu option. Select the example screenshot below to see the full Azure portal window and menu location:
54
+
1. Search for and select *Azure Active Directory*, then select**Users** > **All users**.
55
+
1. Select **Multi-Factor Authentication**. You may need to scroll to the right to see this menu option. Select the example screenshot below to see the full Azure portal window and menu location:
64
56
[![](media/howto-mfa-userstates/selectmfa-cropped.png"Select Multi-Factor Authentication from the Users window in Azure AD")](media/howto-mfa-userstates/selectmfa.png#lightbox)
65
-
4. A new page that displays the user states opens.
66
-
57
+
1. A new page opens that displays the user state, as shown in the following example.
58
+
59
+
60
+
## Change the status for a user
67
61
68
-
### Change the status for a user
62
+
To change the Azure Multi-Factor Authentication state for a user, complete the following steps:
69
63
70
64
1. Use the preceding steps to get to the Azure Multi-Factor Authentication **users** page.
71
-
2. Find the user you want to enable for Azure MFA. You might need to change the view at the top.
65
+
1. Find the user you want to enable for Azure Multi-Factor Authentication. You might need to change the view at the top to **users**.
72
66
73
-
3. Check the box next to their name.
74
-
4. On the right, under **quick steps**, choose **Enable** or **Disable**.
67
+
1. Check the box next to the name(s) of the user(s) to change the state for.
68
+
1. On the right-hand side, under **quick steps**, choose **Enable** or **Disable**. In the following example, the user *John Smith* has a check next to their name and is being enabled for use:
75
69
76
70
77
71
> [!TIP]
78
-
> *Enabled* users are automatically switched to *Enforced* when they register for Azure MFA. Do not manually change the user state to *Enforced*.
72
+
> *Enabled* users are automatically switched to *Enforced* when they register for Azure Multi-Factor Authentication. Don't manually change the user state to *Enforced*.
79
73
80
-
5. Confirm your selection in the pop-up window that opens.
74
+
1. Confirm your selection in the pop-up window that opens.
81
75
82
-
After you enable users, notify them via email. Tell them that they'll be asked to register the next time they sign in. Also, if your organization uses non-browser apps that don't support modern authentication, they need to create app passwords. You can also include a link to the [Azure MFA end-user guide](../user-help/multi-factor-authentication-end-user.md) to help them get started.
76
+
After you enable users, notify them via email. Tell the users that a prompt is displayed to ask them to register the next time they sign in. Also, if your organization uses non-browser apps that don't support modern authentication, they need to create app passwords. For more information, see the [Azure Multi-Factor Authentication end-user guide](../user-help/multi-factor-authentication-end-user.md) to help them get started.
83
77
84
-
### Use PowerShell
78
+
##Change state using PowerShell
85
79
86
-
To change the user state by using [Azure AD PowerShell](/powershell/azure/overview), change `$st.State`. There are three possible states:
80
+
To change the user state by using [Azure AD PowerShell](/powershell/azure/overview), you change the `$st.State` parameter for a user account. There are three possible states for a user account:
87
81
88
-
* Enabled
89
-
* Enforced
90
-
* Disabled
82
+
**Enabled*
83
+
**Enforced*
84
+
**Disabled*
91
85
92
-
Don't move users directly to the *Enforced* state. If you do, non-browser-based apps stop working because the user has not gone through Azure MFA registration and obtained an [app password](howto-mfa-mfasettings.md#app-passwords).
86
+
Don't move users directly to the *Enforced* state. If you do so, non-browser-based apps stop working because the user hasn't gone through Azure Multi-Factor Authentication registration and obtained an [app password](howto-mfa-mfasettings.md#app-passwords).
93
87
94
-
Install the Module first, using:
88
+
To get started, install the *MSOnline* module using[Install-Module](/powershell/module/powershellget/install-module) as follows:
95
89
96
-
```PowerShell
97
-
Install-Module MSOnline
98
-
```
90
+
```PowerShell
91
+
Install-Module MSOnline
92
+
```
99
93
100
-
> [!TIP]
101
-
> Don't forget to connect first using **Connect-MsolService**
94
+
Next, connect using [Connect-MsolService](/powershell/module/msonline/connect-msolservice):
102
95
103
-
```PowerShell
104
-
Connect-MsolService
105
-
```
96
+
```PowerShell
97
+
Connect-MsolService
98
+
```
106
99
107
-
This example PowerShell script enables MFA for an individual user:
100
+
The following example PowerShell script enables MFA for an individual user named *[email protected]*:
Using PowerShell is a good option when you need to bulk enable users. As an example, the following script loops through a list of users and enables MFA on their accounts:
112
+
Using PowerShell is a good option when you need to bulk enable users. The following script loops through a list of users and enables MFA on their accounts. Define the user accounts set it in the first line for `$users` as follows:
120
113
121
114
```PowerShell
115
+
# Define your list of users to update state in bulk
@@ -130,24 +125,22 @@ Using PowerShell is a good option when you need to bulk enable users. As an exam
130
125
}
131
126
```
132
127
133
-
To disable MFA, use this script:
128
+
To disable MFA, the following example gets a user with [Get-MsolUser](/powershell/module/msonline/get-msoluser), then removes any *StrongAuthenticationRequirements* set for the defined user using [Set-MsolUser](/powershell/module/msonline/set-msoluser):
> We recently changed the behavior and PowerShell script above accordingly. Previously, the script saved off the MFA methods, disabled MFA, and restored the methods. This is no longer necessary now that the default behavior for disable doesn't clear the methods.
179
+
> We recently changed the behavior and this PowerShell script. Previously, the script saved off the MFA methods, disabled MFA, and restored the methods. This is no longer necessary now that the default behavior for disable doesn't clear the methods.
187
180
>
188
181
> If MFA is re-enabled on a user object that already has registration details, such as phone or email, then administrators need to have that user re-register MFA via Azure portal or PowerShell. If the user doesn't re-register, their MFA state doesn't transition from *Enabled* to *Enforced* in MFA management UI.
189
182
190
183
## Next steps
191
184
192
-
* Why was a user prompted or not prompted to perform MFA? See the section [Azure AD sign-ins report in the Reports in Azure Multi-Factor Authentication document](howto-mfa-reporting.md#azure-ad-sign-ins-report).
193
-
* To configure additional settings like trusted IPs, custom voice messages, and fraud alerts, see the article [Configure Azure Multi-Factor Authentication settings](howto-mfa-mfasettings.md)
194
-
* Information about managing user settings for Azure Multi-Factor Authentication can be found in the article [Manage user settings with Azure Multi-Factor Authentication in the cloud](howto-mfa-userdevicesettings.md)
185
+
To configure Azure Multi-Factor Authentication settings like trusted IPs, custom voice messages, and fraud alerts, see [Configure Azure Multi-Factor Authentication settings](howto-mfa-mfasettings.md). To manage user settings for Azure Multi-Factor Authentication, see [Manage user settings with Azure Multi-Factor Authentication](howto-mfa-userdevicesettings.md).
186
+
187
+
To understand why a user was prompted or not prompted to perform MFA, see [Azure Multi-Factor Authentication reports](howto-mfa-reporting.md#azure-ad-sign-ins-report).
0 commit comments