131 days agoMicrosoftEnforcement
Azure mandatory MFA Phase 2: last postponement date
Entra IDPowerShell
- Who is affected
- Tenants that postponed Phase 2. User accounts that create, update or delete Azure resources through Azure CLI, Azure PowerShell, the Azure mobile app, IaC tools or REST APIs must complete MFA.
- What to do
- Move automation that signs in as a user account to managed identities or service principals.
- Require MFA with a Conditional Access policy so users satisfy it before they hit errors.
- Give break-glass accounts a passkey (FIDO2) or certificate-based authentication.
- Source
Request more time to prepare for Phase 2 MFA enforcement“Microsoft allows customers with complex environments or technical barriers to postpone the enforcement of Phase 2 for their tenants until July 1st, 2026.”
Planning for mandatory Microsoft Entra multifactor authentication (Microsoft Learn)
On KBY:Conditional Access deployment checklistSecurity keys for Microsoft 365 administrators
Checked 9 Nov 2026 Link to this deadline