# MFA enforced for all org members

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206727542506-mfa-enforced-for-all-org-members
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Microsoft 365 (MS365)](https://support.icompaas.com/support/solutions/folders/f_1781206551953491)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This control ensures that Multi-Factor Authentication (MFA) is enforced for all users within the Microsoft 365 tenant. MFA requires users to provide an additional authentication factor beyond their password before gaining access to organizational resources.

  

Rationale:  
Enforcing MFA for all organization members helps protect accounts from credential theft, phishing attacks, password reuse, and unauthorized access. MFA strengthens identity verification and significantly reduces the likelihood of account compromise.

  

Impact:

-   Reduces the risk of unauthorized access to user accounts.
    
-   Protects against compromised or stolen credentials.
    
-   Improves the organization's overall security posture.
    
-   Supports compliance requirements related to identity and access management.
    
-   Requires users to complete an additional authentication step during sign-in.
    

  

Default Value:  
Disabled by default. Administrators must explicitly configure Microsoft 365 to enforce Multi-Factor Authentication for organization members.

  

Remediation

Test Plan

1.  Sign in to the Microsoft Entra admin center with administrative privileges.
    
2.  Navigate to Protection → Conditional Access.
    
3.  Verify that a Conditional Access policy requiring Multi-Factor Authentication is enabled.
    
4.  Verify that the policy applies to all required users or groups.
    
5.  Select a user account that is subject to the MFA policy.
    
6.  Attempt to sign in to Microsoft 365 without completing Multi-Factor Authentication.
    
7.  Verify that the user is prompted to complete MFA before access is granted.
    
8.  Verify that MFA enforcement applies to all required organization members.
    
9.  If MFA is not enforced for all required users, follow the Implementation Steps to remediate the issue and repeat the test.
    

  

Implementation Steps:

1.  Sign in to the Microsoft Entra admin center with Global Administrator or Security Administrator privileges.
    
2.  Navigate to Protection → Conditional Access.
    
3.  Click Create new policy.
    
4.  Enter a name for the policy.
    
5.  Under Users, select All users or the applicable user groups.
    
6.  Under Target resources, select All cloud apps or the applications required by organizational policy.
    
7.  Under Grant, select Grant access.
    
8.  Enable Require multifactor authentication.
    
9.  Select Require one of the selected controls.
    
10.  Set Enable policy to On.
     
11.  Click Create to apply the policy.
     
12.  Verify that users are required to complete Multi-Factor Authentication when signing in.
     
13.  Verify that MFA enforcement is applied to all required organization members.
     

  

Backout Plan:

1.  Sign in to the Microsoft Entra admin center with Global Administrator or Security Administrator privileges.
    
2.  Navigate to Protection → Conditional Access.
    
3.  Locate the applicable MFA policy.
    
4.  Set Enable policy to Off or modify the policy scope as required.
    
5.  Click Save.
    
6.  Verify that authentication behavior reflects the updated configuration.
    

  

References:

-   [Microsoft Entra Conditional Access Documentation](https://learn.microsoft.com/en-us/entra/identity/conditional-access/)
    
-   [Microsoft Entra Multi-Factor Authentication Documentation](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks)
    
-   [Microsoft 365 Identity and Access Documentation  
      
    ](https://learn.microsoft.com/en-us/microsoft-365/enterprise/security-and-compliance)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.