how to require mfa for all users with entra conditional access

TL;DR

Create a Conditional Access policy targeting all users and all cloud apps with the grant control set to require MFA, but start it in report-only mode. Watch the insights for a week to find service accounts, legacy protocols, and users who never registered MFA, fix those, exclude only the break-glass emergency accounts, and then flip the policy on. Flipping it on blind is how you lock out the whole company on a Monday morning.

Steps

1. In Entra admin go to Protection > Conditional Access > Create new policy. Give it a clear name like "Require MFA for all users". Expected: a new policy saved in report-only or off state.
2. Under Users select All users, then exclude your break-glass emergency accounts, and only those. Expected: the exclusion list contains the break-glass accounts and nothing else.
3. Under Target resources select All cloud apps. Expected: the policy covers every app, not a hand-picked list that someone will forget to extend.
4. Under Grant select Require multifactor authentication. Leave session controls off for version one. Expected: the grant control is set with the operator requiring all selected controls.
5. Enable report-only mode and watch the insights for a week: see who would be blocked. Expected: the report shows affected users with zero actual blocks. Close the SSPR registration gaps and legacy-auth usage it reveals, then switch the policy to On.

Use this when

• Enforcing MFA org-wide for the first time
• Auditors or cyber insurance require MFA for all users
• Replacing a patchwork of per-app MFA rules with one baseline

Not for this skill when

• You only need MFA on specific sensitive apps (use a targeted policy)
• The tenant has no break-glass accounts yet (create those first, then enforce)
• Users have not been told MFA is coming (communicate before the flip, not after)

Compatibility

• Entra ID P1 or P2 (Conditional Access needs P1+)
• Microsoft Authenticator or equivalent MFA methods registered by users

Variants

Legacy protocols like IMAP and POP are in the environment

These protocols cannot do MFA at all. Add a companion policy blocking legacy authentication.

Phased rollout by department

Scope the Users selector to a pilot group first, validate, then widen to All users.

Why it happens

MFA for everyone is the single highest-leverage identity control, but enforcing it blind breaks service accounts, legacy protocols, and users who never registered a method. Report-only mode surfaces all of that before any user feels it.

Edge cases

• Service accounts and automation: exclude them by named account and give them their own policy with a different control. Never blanket-exempt them silently.
• Guest users: decide explicitly whether the policy includes guests and document the choice.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_kg5FtjvuucesuV84Flw8KA