Require MFA for all users on all resources

Description

A Conditional Access policy requires multifactor authentication for All users on All resources, with the built-in Multifactor authentication authentication strength (or the Require multifactor authentication grant). It applies from every location, including trusted networks.

The policy excludes only the emergency access accounts and, on hybrid tenants, the Directory Synchronization Accounts role. Guests stay included: they satisfy the requirement in their home tenant when the cross-tenant access settings trust its MFA, otherwise in this tenant.

Administrators need a stronger method: see CB-M365-AUTH-004. A Microsoft-managed policy Multifactor authentication for all users satisfies this control once it is On and keeps the same scope.

Excluding trusted locations is a frequent shortcut; this control does not allow it. Use sign-in frequency and persistent browser settings to limit how often users are prompted instead.

Rationale

Passwords are phished, reused, sprayed and bought. MFA stops most account takeovers that start with a password. A policy limited to some applications or excluding trusted networks leaves gaps that attackers find quickly, for example the Azure management endpoints or a VPN egress IP.

Impact

Every user must register an MFA method before enforcement (see CB-M365-AUTH-018). Service accounts that sign in interactively break: replace them with workload identities (managed identities or service principals), which Conditional Access for users does not target. Shared and kiosk devices need a method usable by several people, such as security keys.

Applies when

Requires: Microsoft Entra ID P1

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State set to On (not Report-only) where:
   • Users > Include is All users;
   • Users > Exclude contains only the emergency access accounts and, if synchronization is used, the Directory Synchronization Accounts role;
   • Target resources includes All resources, without exclusions;
   • Network is not configured, or does not exclude any location;
   • Grant is Require authentication strength (Multifactor authentication or stronger) or Require multifactor authentication.
4. Use What If (or the sign-in logs) for a standard user on Office 365 to confirm the policy applies.
5. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.Users.IncludeUsers -contains 'All' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}, @{n='Strength';e={$_.GrantControls.AuthenticationStrength.Id}}
6. Fail if no such policy exists, if it is Report-only or Off, or if it excludes users, groups, applications or locations beyond those listed above.

Remediation

1. Check registration first: Entra ID > Authentication methods > User registration details, filter on Not capable, and get those users registered.
2. As at least a Conditional Access Administrator, browse to Entra ID > Conditional Access > Policies and select New policy.
3. Name it, for example ALL - Require MFA.
4. Users > Include: All users. Exclude: the emergency access accounts and, on hybrid tenants, the Directory Synchronization Accounts role.
5. Target resources > Resources > Include: All resources.
6. Grant > Grant access > Require authentication strength > Multifactor authentication.
7. Set Enable policy to Report-only, save, and review the sign-in logs for a few days.
8. Switch Enable policy to On. Graph equivalent: New-MgIdentityConditionalAccessPolicy with conditions.users.includeUsers set to All, conditions.applications.includeApplications set to All and grantControls.authenticationStrength.id set to 00000000-0000-0000-0000-000000000002 (built-in Multifactor authentication strength).

Rollback

Set the policy to Report-only. Sign in with an emergency access account if needed.

References

• Require MFA for all users with Conditional Access Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft-managed policies Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-001 Block legacy authentication with Conditional Access
• related CB-M365-AUTH-002 Enable security defaults on tenants without Microsoft Entra ID P1
• related CB-M365-AUTH-004 Require phishing-resistant MFA for administrative roles
• related CB-M365-AUTH-005 Require phishing-resistant MFA for all users
• related CB-M365-AUTH-010 Disable per-user MFA for every user
• related CB-M365-AUTH-018 Make sure every member user has registered an MFA method
• related CB-M365-ADMIN-002 Keep two protected emergency access accounts
• related CB-M365-AUTH-025 Require users to sign in again at least every {{ user_signin_frequency_days }} days
• related CB-M365-AUTH-034 Keep Conditional Access policies free of broken references and unprotected exclusions
• related CB-M365-DEVICE-009 Require MFA to register or join devices through Conditional Access

People and lifecycle