# MFA Conditional Access Policy - DEPRECATED

> Enforce MFA for all admins on the tenant.

Enforce MFA for all admins on the tenant. This policy has been deprecated.  It is still safe to use however it should be replaced with "Conditional Access Policy - MFA" which can be added from the Octiga Best Practice Template.

## Settings this baseline controls

| Setting       | What it does                                                                                                                                                                                                                                                                   |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Policy name   | Specifies a display name for the conditional Access Policy [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa)                                                                                 |
| Enable policy | Specifies the state of the conditional Access Policy. Possible values are: enabled, disabled, enabledForReportingButNotEnforced. Required. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline still works and is safe to use, but it's an older, narrower way of enforcing MFA for admin roles, superseded by a newer MFA baseline in Octiga's best-practice scheme. Check what's already deployed on the tenant before adding this one, so admins aren't covered by two separate MFA policies at once.

1. Add the baseline to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or carry it in a scheme you deploy to every tenant you manage (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). It targets a fixed set of built-in admin directory roles, with no per-user targeting to configure.
2. Set **Enable policy** to `enabled` to enforce it, or to `enabledForReportingButNotEnforced` first to confirm which admins would be affected before anyone is challenged.
3. **Save.** Turn on **Auto-remediation** if you want Octiga to reapply this policy automatically whenever it's changed in Microsoft 365.

> **Caution:** This baseline doesn't exclude break-glass accounts on its own. Before you enforce it, confirm your organisation's emergency access accounts aren't in the built-in admin roles it targets, or that they have another way in. Otherwise, if MFA becomes unreachable, every admin role could be locked out at once.

> **Licence: Entra ID P1 or P2:** This baseline needs Entra ID P1 or P2 on the tenant. Without it, Octiga excludes the baseline rather than reporting it as deviated (see [Licence requirements](https://docs.octiga.io/reference/licence-requirements/)).

## Check it worked

After the next sync, this baseline shows **Passing** once a policy with `state` set to `enabled` and the multi-factor authentication grant control, scoped to the admin roles it covers, exists in Microsoft Entra. Check it in the Microsoft Entra admin centre under **Entra ID > Conditional Access > Policies**. Admins holding one of the covered roles see a multi-factor authentication prompt the next time they sign in; everyone else is unaffected.

## Standards this addresses

### CIS

- **M365 5.2.2.1** — CIS M365 Foundations Benchmark 5.2.2.1
- **v8 6.3** — CIS Controls v8 Safeguard 6.3
- **v8 6.5** — CIS Controls v8 Safeguard 6.5

### NIST

- **PR.AC-1** — NIST CSF 2.0 PR.AC-1
- **PR.AC-7** — NIST CSF 2.0 PR.AC-7
- **IA-2** — NIST SP 800-53 IA-2

### ISO 27001

- **A.8.3** — ISO/IEC 27001:2022 Annex A.8.3
- **A.8.3.3** — ISO/IEC 27001:2022 Annex A.8.3.3

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)