Question

You are the Microsoft 365 administrator at Contoso. Recent sign-in logs show several successful sign-ins to privileged accounts from unfamiliar locations without any second-factor prompt. Management wants to ensure that all users assigned directory administrator roles (such as Global Administrator and User Administrator) must complete multifactor authentication every time they sign in, regardless of location or device. You want to enforce this with the least administrative effort while keeping the control targeted. What should you do?

Accepted Answer

Create a Conditional Access policy that targets the directory roles as the assignment, sets the cloud apps to All cloud apps, and requires multifactor authentication as the grant control.

Answer

Enable security defaults for the tenant so that all administrators are prompted to register and use MFA.

Answer

Create a Conditional Access policy that targets All users with a grant control requiring MFA, and exclude standard users manually.

Answer

Enable per-user MFA from the legacy multifactor authentication portal for each administrator account individually.