How to require MFA for administrator roles in Entra ID

What this check looks at

Checks for an enabled Conditional Access policy requiring MFA, or an authentication strength, for every administrator role CIS lists, across all resources with none left out.

Conditional Access can target directory roles, so a policy applies to whoever holds a role when they sign in, including administrators added later. A policy requiring MFA for the administrator roles means every admin sign-in asks for a second factor, even where the all-user MFA policy has exclusions or is not yet in place.

The check, for tenants with Entra ID P1, looks for an enabled policy that grants access with MFA or an authentication strength (not a block), targets All resources with no resource excluded, and covers every administrator role in its list: Global, Privileged Role, Security, Conditional Access, Exchange, SharePoint, User, Helpdesk, Authentication, Application, Cloud Application and Billing Administrator. A policy for All users also qualifies. It warns when such a policy is report-only, or when an enabled one covers only some roles, and names the roles left out; it fails when there is none.

Administrators who registered MFA but are not required to use it can still sign in with a password alone wherever no other policy applies. A role-based policy that lists only Global Administrator leaves Exchange, SharePoint and User Administrators, each powerful enough to read mail or reset passwords, protected by a password.

Why it matters

Administrators who have registered MFA but are not required to use it can still sign in with a password alone. A policy on the roles themselves makes MFA certain for every administrator, including the ones added next month.

An attacker who phishes an Exchange Administrator’s password can give themselves full access to every mailbox or set up organisation-wide forwarding; with a User Administrator they can reset other people’s passwords and MFA. In small firms these roles are often given to an office manager or junior IT person for convenience, and they are watched less closely than the Global Administrators.

A role-based MFA policy costs nothing extra in a tenant with Entra ID P1 and stays correct as people come and go, because it follows the role rather than a list of names.

The CIS Microsoft 365 Foundations Benchmark (5.2.2.1) asks for MFA for administrative roles through Conditional Access, Cyber Essentials requires every administrator to use MFA, and the rule maps to NIST CSF 2.0 PR.AA-03.

How to fix it

Where: Entra admin centre → Protection → Conditional Access

Before you start

• Confirm two emergency access (break-glass) accounts exist and exclude them from the policy, so a mistake cannot lock every administrator out.
• Check each administrator has registered MFA, or they are prompted at their next admin sign-in.
• Create the policy in report-only mode first and review its results in Entra ID sign-in logs (Conditional Access tab) for at least a week.

Step by step

1. 1Check the emergency access accounts and admin registration. Confirm two emergency access accounts exist and are in the group excluded from Conditional Access, and that every administrator has registered MFA (Entra ID > Authentication methods > User registration details); anyone who has not is asked to register at their next admin sign-in.
2. 2Create the policy and choose the roles. In the Microsoft Entra admin centre, go to Entra ID > Conditional Access > Policies > New policy, named "CA01 – Admin roles – Require MFA". Under Users, choose Select users and groups > Directory roles and tick Global, Privileged Role, Security, Conditional Access, Exchange, SharePoint, User, Helpdesk, Authentication, Application, Cloud Application and Billing Administrator, plus any other admin role in use. Exclude the emergency access group.
3. 3Set the resources and grant, in report-only mode. Under Target resources, include All resources and leave Exclude empty: excluding any resource fails this check. Under Grant, choose Grant access and tick Require multifactor authentication, or Require authentication strength with a phishing-resistant strength if administrators already use passkeys. Set Enable policy to Report-only and select Create.
4. 4Review the report-only results. After a few days, open administrators’ sign-ins in Entra ID > Monitoring & health > Sign-in logs and look at this policy on the Report-only tab. An admin sign-in that did not satisfy MFA points to someone who still needs to register, or to an admin account used by a script that should become an app registration.
5. 5Switch the policy on. Set Enable policy to On and select Save. If an older policy covers only Global Administrator, delete it once this one is on.
6. 6Confirm. Run What If (Conditional Access > Policies > What If) for an Exchange or User Administrator against any resource: the policy should apply. Re-run the assessment; it passes when an enabled policy covers every listed role on all resources.

What users will notice

Administrators are asked for MFA whenever they use an administrator role, on any app or portal.

How to confirm it worked

In the sign-in logs, an administrator’s recent sign-ins show the policy as "Success" with MFA satisfied; the policy state is On.

Frameworks and controls

This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Require MFA for administrators (Microsoft Learn)

Related checks

• Require approval to activate Global Administrator in PIM
• Why admin accounts should not have Microsoft 365 licences
• How to set sign-in frequency for administrators
• How to get alerts when admin roles are assigned in PIM

The full Microsoft 365 security checklist, worst first