Require MFA

CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA

Require MFA

About this policy

The CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA policy requires multifactor authentication for your internal users group across every cloud app, covering browser and modern client sign-ins from all locations. It is the workhorse of the internals tier in this framework, built around an inclusion group so you control exactly who is in scope while rolling it out. A couple of exclusion groups handle break glass accounts and other exceptions. Straightforward, but it is the single control that defeats most credential theft.

Policy conditions

Users: Specific users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('8fd6f72c-f850-4f00-83cc-e27e41961aa9')",
  "@odata.editLink": "identity/conditionalAccess/policies('8fd6f72c-f850-4f00-83cc-e27e41961aa9')",
  "templateId": null,
  "displayName": "CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "browser",
      "mobileAppsAndDesktopClients"
    ],
    "platforms": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [
        "ceeac9b8-ddf5-48cb-afcb-e2ab8bfd1a57"
      ],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "cfa1f128-ec48-4ee1-9ea9-1c28fdb57722",
        "2802b872-ccfb-4b29-a9a9-459808dfb11b"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "locations": {
      "@odata.type": "#microsoft.graph.conditionalAccessLocations",
      "includeLocations@odata.type": "#Collection(String)",
      "includeLocations": [
        "All"
      ],
      "excludeLocations@odata.type": "#Collection(String)",
      "excludeLocations": []
    }
  },
  "grantControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
    "operator": "OR",
    "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
    "builtInControls": [
      "mfa"
    ],
    "customAuthenticationFactors@odata.type": "#Collection(String)",
    "customAuthenticationFactors": [],
    "termsOfUse@odata.type": "#Collection(String)",
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('8fd6f72c-f850-4f00-83cc-e27e41961aa9')/grantControls/authenticationStrength/$entity",
    "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('8fd6f72c-f850-4f00-83cc-e27e41961aa9')/grantControls/authenticationStrength/$ref",
    "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('8fd6f72c-f850-4f00-83cc-e27e41961aa9')/grantControls/authenticationStrength",
    "authenticationStrength": null
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('8fd6f72c-f850-4f00-83cc-e27e41961aa9')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA200-Internals-IdentityProtection-AnyApp-AnyPlatform-MFA policy requires multifactor authentication for your internal users group across every cloud app, covering browser and modern client sign-ins from all locations. It is the workhorse of the internals tier in this framework, built around an inclusion group so you control exactly who is in scope while rolling it out. A couple of exclusion groups handle break glass accounts and other exceptions. Straightforward, but it is the single control that defeats most credential theft."
}