Require MFA

CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA

Require MFA

About this policy

The CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA policy is the foundation of this framework. It asks every user for multifactor authentication when signing in to any cloud app, on any platform. A handful of exclusion groups keep break glass accounts and other special cases out of scope, and the directory synchronisation role is excluded so Entra Connect keeps running smoothly. If you only deploy one policy from this set, make it this one, as it shuts down the vast majority of password based attacks.

Policy conditions

Users: All users
Exclusion: Excludes privileged roles
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('809741fe-fb1b-4746-9ff0-83a978a4c891')",
  "@odata.editLink": "identity/conditionalAccess/policies('809741fe-fb1b-4746-9ff0-83a978a4c891')",
  "templateId": null,
  "displayName": "CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [
        "All"
      ],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "8e75af29-5176-4372-a718-724b8a4620dc",
        "cfa1f128-ec48-4ee1-9ea9-1c28fdb57722",
        "2eee133e-3427-4860-81b9-057d5b28b022",
        "349156c1-2fb1-4ffa-9cd3-5c4418e24e4c",
        "7452a2db-063a-4048-84b0-ff691fa2900e",
        "2802b872-ccfb-4b29-a9a9-459808dfb11b",
        "68ce874b-21a9-4ca9-b447-f09a037be53a"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [
        "d29b2b05-8046-44ba-8758-1e26182fcf32"
      ],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "grantControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
    "operator": "OR",
    "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
    "builtInControls": [
      "mfa"
    ],
    "customAuthenticationFactors@odata.type": "#Collection(String)",
    "customAuthenticationFactors": [],
    "termsOfUse@odata.type": "#Collection(String)",
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('809741fe-fb1b-4746-9ff0-83a978a4c891')/grantControls/authenticationStrength/$entity",
    "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('809741fe-fb1b-4746-9ff0-83a978a4c891')/grantControls/authenticationStrength/$ref",
    "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('809741fe-fb1b-4746-9ff0-83a978a4c891')/grantControls/authenticationStrength",
    "authenticationStrength": null
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('809741fe-fb1b-4746-9ff0-83a978a4c891')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA000-Global-IdentityProtection-AnyApp-AnyPlatform-MFA policy is the foundation of this framework. It asks every user for multifactor authentication when signing in to any cloud app, on any platform. A handful of exclusion groups keep break glass accounts and other special cases out of scope, and the directory synchronisation role is excluded so Entra Connect keeps running smoothly. If you only deploy one policy from this set, make it this one, as it shuts down the vast majority of password based attacks."
}