Require MFA

CIS - MFA for all users

Require MFA

About this policy

The CIS - MFA for all users policy requires all users in your tenant to complete multi-factor authentication when accessing any cloud app. This is arguably the single most impactful Conditional Access policy you can deploy, as it significantly raises the barrier for anyone attempting to access your environment using stolen credentials. It covers every user and every app with no exceptions built in by default, so consider whether any service accounts or break-glass accounts need excluding.

Policy conditions

Users: All users
Apps: All cloud apps

JSON template

{
  "templateId": null,
  "displayName": "CIS - MFA for all users",
  "modifiedDateTime": null,
  "state": "enabledForReportingButNotEnforced",
  "deletedDateTime": null,
  "partialEnablementStrategy": null,
  "sessionControls": null,
  "conditions": {
    "userRiskLevels": [],
    "signInRiskLevels": [],
    "clientAppTypes": [
      "all"
    ],
    "platforms": null,
    "locations": null,
    "times": null,
    "deviceStates": null,
    "devices": null,
    "clientApplications": null,
    "agents": null,
    "applications": {
      "includeApplications": [
        "All"
      ],
      "excludeApplications": [],
      "includeUserActions": [],
      "includeAuthenticationContextClassReferences": [],
      "applicationFilter": null
    },
    "users": {
      "includeUsers": [
        "All"
      ],
      "excludeUsers": [],
      "includeGroups": [],
      "excludeGroups": [],
      "includeRoles": [],
      "excludeRoles": [],
      "includeGuestsOrExternalUsers": null,
      "excludeGuestsOrExternalUsers": null
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": [
      "mfa"
    ],
    "customAuthenticationFactors": [],
    "termsOfUse": [],
    "authenticationStrength@odata.context": "https://graph.microsoft.com/beta/$metadata#identity/conditionalAccess/policies('2712564c-79ea-4cb9-bfff-a49c1f6f34a5')/grantControls/authenticationStrength/$entity",
    "authenticationStrength": null
  },
  "Tag": "CIS",
  "summary": "The CIS - MFA for all users policy requires all users in your tenant to complete multi-factor authentication when accessing any cloud app. This is arguably the single most impactful Conditional Access policy you can deploy, as it significantly raises the barrier for anyone attempting to access your environment using stolen credentials. It covers every user and every app with no exceptions built in by default, so consider whether any service accounts or break-glass accounts need excluding."
}