Skip to content

policy-admin-phish-resistant-mfa.md

Latest commit

 

History

History
71 lines (49 loc) · 5.11 KB

policy-admin-phish-resistant-mfa.md

File metadata and controls

71 lines (49 loc) · 5.11 KB
title Require phishing-resistant multifactor authentication for Microsoft Entra administrator roles
description Create a Conditional Access policy requiring stronger authentication methods for highly privileged roles in your organization.
ms.topic how-to
ms.date 03/24/2026
ms.reviewer lhuangnorth

Require phishing-resistant multifactor authentication for administrators

Overview

Accounts with privileged administrative roles are frequent targets of attackers. Requiring phishing-resistant multifactor authentication (MFA) for these accounts reduces the risk of compromise.

Caution

Before creating a policy requiring phishing-resistant multifactor authentication, make sure your administrators register the appropriate methods. Enabling this policy without completing this step risks locking you out of your tenant. Administrators can configure Temporary Access Pass to register passwordless authentication methods or follow the steps in register a passkey (FIDO2).

Microsoft recommends requiring phishing-resistant multifactor authentication for at least the following roles:

[!INCLUDE conditional-access-admin-roles]

Organizations can include or exclude roles based on their requirements.

Organizations can use this policy with features like Privileged Identity Management (PIM), which lets you require MFA for role activation.

Authentication strength

This article helps your organization create an MFA policy for your environment using authentication strengths. Microsoft Entra ID offers three built-in authentication strengths:

  • Multifactor authentication strength (less restrictive)
  • Passwordless MFA strength
  • Phishing-resistant MFA strength (most restrictive), recommended in this article

Use one of the built-in strengths or create a custom authentication strength based on the authentication methods you want to require.

For external user scenarios, the MFA authentication methods that a resource tenant accepts vary depending on whether the user completes MFA in their home tenant or in the resource tenant. For more information, see Authentication strength for external users.

User exclusions

[!INCLUDE active-directory-policy-exclusions]

[!INCLUDE active-directory-policy-deploy-template]

Create a Conditional Access policy

Warning

If you use external authentication methods, these methods are currently incompatible with authentication strengths. Use the Require multifactor authentication grant control instead.

  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policies.
  3. Select New policy.
  4. Name your policy. Create a meaningful naming standard for your organization's policies.
  5. Under Assignments, select Users or workload identities.

    1. Under Include, select Directory roles and choose at least the previously listed roles.

      [!WARNING] Conditional Access policies support built-in roles. Conditional Access policies aren't enforced for other role types including administrative unit-scoped or custom roles.

    2. Under Exclude, select Users and groups, and choose your organization's emergency access or break-glass accounts.

  6. Under Target resources > Resources (formerly cloud apps) > Include, select All resources (formerly 'All cloud apps').
  7. Under Access controls > Grant, select Grant access.
    1. Select Require authentication strength, then select Phishing-resistant MFA strength from the list.
    2. Select Select.
  8. Confirm your settings, and set Enable policy to Report-only.
  9. Select Create to enable your policy.

[!INCLUDE conditional-access-report-only-mode]

Related content