MFA Conditional Access Policy - DEPRECATED

Enforce MFA for all admins on the tenant. This policy has been deprecated. It is still safe to use however it should be replaced with “Conditional Access Policy - MFA” which can be added from the Octiga Best Practice Template.

Settings this baseline controls

Setting	What it does
Policy name	Specifies a display name for the conditional Access Policy Learn more
Enable policy	Specifies the state of the conditional Access Policy. Possible values are: enabled, disabled, enabledForReportingButNotEnforced. Required. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline still works and is safe to use, but it’s an older, narrower way of enforcing MFA for admin roles, superseded by a newer MFA baseline in Octiga’s best-practice scheme. Check what’s already deployed on the tenant before adding this one, so admins aren’t covered by two separate MFA policies at once.

1. Add the baseline to the tenant directly (see Adding a baseline), or carry it in a scheme you deploy to every tenant you manage (see Deploying a scheme). It targets a fixed set of built-in admin directory roles, with no per-user targeting to configure.

2. Set Enable policy to enabled to enforce it, or to enabledForReportingButNotEnforced first to confirm which admins would be affected before anyone is challenged.

3. Save.

   Turn on Auto-remediation if you want Octiga to reapply this policy automatically whenever it’s changed in Microsoft 365.

Caution

This baseline doesn’t exclude break-glass accounts on its own. Before you enforce it, confirm your organisation’s emergency access accounts aren’t in the built-in admin roles it targets, or that they have another way in. Otherwise, if MFA becomes unreachable, every admin role could be locked out at once.

Licence: Entra ID P1 or P2

This baseline needs Entra ID P1 or P2 on the tenant. Without it, Octiga excludes the baseline rather than reporting it as deviated (see Licence requirements).

Check it worked

After the next sync, this baseline shows Passing once a policy with state set to enabled and the multi-factor authentication grant control, scoped to the admin roles it covers, exists in Microsoft Entra. Check it in the Microsoft Entra admin centre under Entra ID > Conditional Access > Policies. Admins holding one of the covered roles see a multi-factor authentication prompt the next time they sign in; everyone else is unaffected.

Standards this addresses

CISM365 5.2.2.1v8 6.3v8 6.5

NISTPR.AC-1PR.AC-7IA-2

ISO 27001A.8.3A.8.3.3

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→