Require MFA

CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA

Require MFA

About this policy

The CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA policy applies multifactor authentication to a dedicated service accounts group across all cloud apps and locations. Service accounts ideally should not be signing in interactively at all, so if one does, this policy makes sure it faces a proper challenge rather than sliding through on a password alone. Several exclusion groups are available for accounts that genuinely cannot support MFA, though those should be protected by the companion location policy instead.

Policy conditions

Users: Specific users
Apps: All cloud apps

JSON template

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies/$entity",
  "@odata.type": "#microsoft.graph.conditionalAccessPolicy",
  "@odata.id": "identity/conditionalAccess/policies('bfcb905d-8c0a-453c-99b5-4c64e41eb772')",
  "@odata.editLink": "identity/conditionalAccess/policies('bfcb905d-8c0a-453c-99b5-4c64e41eb772')",
  "templateId": null,
  "displayName": "CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA",
  "createdDateTime@odata.type": "#DateTimeOffset",
  "modifiedDateTime@odata.type": "#DateTimeOffset",
  "state@odata.type": "#microsoft.graph.conditionalAccessPolicyState",
  "state": "enabled",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "@odata.type": "#microsoft.graph.conditionalAccessConditionSet",
    "userRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "userRiskLevels": [],
    "signInRiskLevels@odata.type": "#Collection(microsoft.graph.riskLevel)",
    "signInRiskLevels": [],
    "clientAppTypes@odata.type": "#Collection(microsoft.graph.conditionalAccessClientApp)",
    "clientAppTypes": [
      "browser",
      "mobileAppsAndDesktopClients"
    ],
    "platforms": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "@odata.type": "#microsoft.graph.conditionalAccessApplications",
      "includeApplications@odata.type": "#Collection(String)",
      "includeApplications": [
        "All"
      ],
      "excludeApplications@odata.type": "#Collection(String)",
      "excludeApplications": [],
      "includeUserActions@odata.type": "#Collection(String)",
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences@odata.type": "#Collection(String)",
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "@odata.type": "#microsoft.graph.conditionalAccessUsers",
      "includeUsers@odata.type": "#Collection(String)",
      "includeUsers": [],
      "excludeUsers@odata.type": "#Collection(String)",
      "excludeUsers": [],
      "includeGroups@odata.type": "#Collection(String)",
      "includeGroups": [
        "77c1ed37-10d0-4ef1-93dc-198e70abb166"
      ],
      "excludeGroups@odata.type": "#Collection(String)",
      "excludeGroups": [
        "cfa1f128-ec48-4ee1-9ea9-1c28fdb57722",
        "2802b872-ccfb-4b29-a9a9-459808dfb11b",
        "70899f87-a5ba-4145-8bd5-2230db5dbbff",
        "349156c1-2fb1-4ffa-9cd3-5c4418e24e4c",
        "7452a2db-063a-4048-84b0-ff691fa2900e",
        "68ce874b-21a9-4ca9-b447-f09a037be53a",
        "8e75af29-5176-4372-a718-724b8a4620dc"
      ],
      "includeRoles@odata.type": "#Collection(String)",
      "includeRoles": [],
      "excludeRoles@odata.type": "#Collection(String)",
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    },
    "locations": {
      "@odata.type": "#microsoft.graph.conditionalAccessLocations",
      "includeLocations@odata.type": "#Collection(String)",
      "includeLocations": [
        "All"
      ],
      "excludeLocations@odata.type": "#Collection(String)",
      "excludeLocations": []
    }
  },
  "grantControls": {
    "@odata.type": "#microsoft.graph.conditionalAccessGrantControls",
    "operator": "OR",
    "builtInControls@odata.type": "#Collection(microsoft.graph.conditionalAccessGrantControl)",
    "builtInControls": [
      "mfa"
    ],
    "customAuthenticationFactors@odata.type": "#Collection(String)",
    "customAuthenticationFactors": [],
    "termsOfUse@odata.type": "#Collection(String)",
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('bfcb905d-8c0a-453c-99b5-4c64e41eb772')/grantControls/authenticationStrength/$entity",
    "authenticationStrength@odata.associationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('bfcb905d-8c0a-453c-99b5-4c64e41eb772')/grantControls/authenticationStrength/$ref",
    "authenticationStrength@odata.navigationLink": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('bfcb905d-8c0a-453c-99b5-4c64e41eb772')/grantControls/authenticationStrength",
    "authenticationStrength": null
  },
  "#microsoft.graph.restore": {
    "title": "microsoft.graph.restore",
    "target": "https://graph.microsoft.com/beta/identity/conditionalAccess/policies('bfcb905d-8c0a-453c-99b5-4c64e41eb772')/microsoft.graph.restore"
  },
  "Tag": "jv-CAF-2026.2.1",
  "summary": "The CA300-ServiceAccounts-IdentityProtection-AnyApp-AnyPlatform-MFA policy applies multifactor authentication to a dedicated service accounts group across all cloud apps and locations. Service accounts ideally should not be signing in interactively at all, so if one does, this policy makes sure it faces a proper challenge rather than sliding through on a password alone. Several exclusion groups are available for accounts that genuinely cannot support MFA, though those should be protected by the companion location policy instead."
}