# Enforce MFA > This Conditional Access Policy enforces Multi-Factor Authentication (MFA) for all users, requiring an additional verification step beyond just a password. This Conditional Access Policy enforces Multi-Factor Authentication (MFA) for all users, requiring an additional verification step beyond just a password. Enforcing MFA significantly increases account security and helps protect against unauthorized access. ## Settings this baseline controls | Setting | What it does | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Policy name | Specifies a display name for the Conditional Access Policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | | Enable policy | Specifies the state of the conditional Access Policy. Possible values are: enabled, disabled, enabledForReportingButNotEnforced. Required. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | | Included users | User IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | | Included roles | Role IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | | Included groups | Group IDs in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | | Included guest types | Guest or external user types in scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | | Excluded users | User IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | | Excluded roles | Role IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | **3 more settings** | Setting | What it does | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Excluded groups | Group IDs excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | | Excluded guest types | Guest or external user types excluded from scope of policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | | Grant controls | List of values of built-in controls required by the policy. Possible values: block, mfa, compliantDevice, domainJoinedDevice, approvedApplication, compliantApplication, passwordChange, unknownFutureValue [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this baseline when every sign-in to the tenant should require multi-factor authentication, not only admin sign-ins. 1. Add the baseline to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or carry it in a scheme you deploy to every tenant you manage (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Leave **Included users** covering everyone, so the policy reaches the whole tenant, and use **Excluded users** or **Excluded groups** for your organisation's break-glass accounts only. 3. Leave **Grant controls** set to require multi-factor authentication. This is what enforces MFA; without it, the policy only watches sign-ins and changes nothing. 4. Set **Enable policy** to `enabled` to enforce it straight away, or to `enabledForReportingButNotEnforced` first if you want to see who it would affect before anyone is challenged. 5. **Save.** Turn on **Auto-remediation** if you want Octiga to reapply the policy whenever it's changed in Microsoft 365, so MFA stays enforced without anyone needing to check. End users see nothing beyond the MFA prompt the policy already asks for. > **Caution:** Add your break-glass accounts under **Excluded users** before you enforce this policy, so you can't lock yourself out if MFA is ever unreachable. > **Licence: Entra ID P1 or P2:** This baseline needs Entra ID P1 or P2 on the tenant. Without it, Octiga excludes the baseline rather than reporting it as deviated — see [Licence requirements](https://docs.octiga.io/reference/licence-requirements/). ## Check it worked After the next sync, this baseline shows **Passing** once a policy with `state` set to `enabled` (or `enabledForReportingButNotEnforced`) and the multi-factor authentication grant control exists in Microsoft Entra. You can confirm it in the Microsoft Entra admin centre under **Entra ID > Conditional Access > Policies**. End users see a multi-factor authentication prompt the next time they sign in, unless they're already satisfying it another way, such as Windows Hello for Business. ## Standards this addresses ### CIS - **M365 5.2.2.1** — CIS M365 Foundations Benchmark 5.2.2.1 - **M365 5.2.2.2** — CIS M365 Foundations Benchmark 5.2.2.2 - **v8 6.3** — CIS Controls v8 Safeguard 6.3 - **v8 6.5** — CIS Controls v8 Safeguard 6.5 ### NIST - **PR.AC-1** — NIST CSF 2.0 PR.AC-1 - **PR.AC-7** — NIST CSF 2.0 PR.AC-7 - **IA-2** — NIST SP 800-53 IA-2 ### ISO 27001 - **A.8.3** — ISO/IEC 27001:2022 Annex A.8.3 - **A.8.3.3** — ISO/IEC 27001:2022 Annex A.8.3.3 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)