Per User MFA

Per User MFA.

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline applies per user, through a user-level scheme or an Azure group, rather than to the tenant as a whole.

1. Add it directly to a user or an Azure group (Adding a baseline), or bundle it into a user-level scheme and deploy that to many users or groups at once (Deploying a scheme). See Groups and priority for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.

2. Move the user’s per-user MFA status off Disabled. This is the only setting on this baseline, and it passes at either Enabled or Enforced. Set new enrolments to Enabled: the user keeps using legacy authentication until they finish registering, at which point Microsoft moves them to Enforced automatically.

3. Save. Turn on Auto-remediation if you’d like Octiga to enrol a Disabled user for you. It sets them to Enabled, the same safe starting state, and never jumps a user straight to Enforced.

Caution

Enforced blocks legacy authentication protocols outright (they need an app password instead) and requires MFA registration or a fresh sign-in for everything else. Set a user to Enforced directly only once you know they’ve registered; for someone who hasn’t, it interrupts their access rather than prompting them.

Check it worked

Passing means the user’s status is Enabled or Enforced. Check it in the Microsoft Entra admin centre, under Identity → Users → Per-user MFA. On the user roster or a group’s member list, Passing shows as a green dot for this baseline; Deviated (red) means the user is still Disabled. A newly Enabled user notices a registration prompt at their next sign-in; once Enforced, they’re asked for MFA at every sign-in that needs it.

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→