How to Set Up Azure Multi-Factor Authentication

Azure Multi-Factor Authentication (MFA) adds an extra layer of security to your accounts by requiring a second verification step, making it harder for unauthorised access. Here's how to set it up and why it matters for UK businesses:

• Why Use MFA?
  • Better Security: Protects against stolen passwords.
  • Compliance: Meets UK GDPR and data protection rules.
  • User-Friendly: Only needed for new devices or risky logins.
  • Multiple Methods: Choose from apps, biometrics, or SMS.
• What You Need:
  • A Global Administrator account.
  • A Microsoft Entra ID P1 or P2 licence for advanced features.
  • Disable legacy MFA if using Security Defaults or Conditional Access.
• How to Enable MFA:
  1. Log in to the Microsoft Entra admin centre.
  2. Create a Conditional Access policy targeting users or groups.
  3. Set rules to require MFA for all cloud apps.
  4. Guide users to register with the Microsoft Authenticator app.
• UK-Specific Compliance Tips:
  • Conduct a Data Protection Impact Assessment (DPIA) for biometric data.
  • Encrypt stored verification data.
  • Ensure users can request data erasure or access.
• Best Practices:
  • Use the Microsoft Authenticator app for higher security and ease.
  • Exclude emergency accounts to avoid lockouts.
  • Roll out MFA in phases, starting with a test group.

Follow these steps to secure your organisation, comply with UK regulations, and reduce the risk of cyber-attacks.

Before You Start

System Requirements

To set up MFA, you’ll need the following:

• A Global administrator account to manage MFA settings.
• A Microsoft Entra ID P1 licence (included with Microsoft 365 Business Premium or Microsoft 365 E3) for Conditional Access policies.
• A Microsoft Entra ID P2 licence (included with Microsoft 365 E5) if you plan to implement risk-based Conditional Access.

Important: If you’re currently using legacy per-user MFA, make sure to disable it before enabling Security Defaults or Conditional Access policies. This prevents authentication conflicts.

MFA Verification Methods

Azure provides several methods for verification, balancing security with user convenience:

Recommendation: Use the Microsoft Authenticator app as your primary method. It supports push notifications, works offline, and is more dependable than SMS-based verification.

UK Data Protection Rules

To comply with UK GDPR requirements, follow these steps:

1. Data Protection Impact Assessment (DPIA)
   Before implementing MFA, conduct a DPIA if you’ll process biometric data. Clearly document how MFA improves security while respecting user privacy.
2. Technical Measures
   Strengthen security by applying these controls:
   • Encrypt stored verification data.
   • Perform regular security audits.
   • Monitor authentication attempts.
   • Maintain detailed access logs.
3. User Rights
   Ensure your MFA setup supports:
   • Data subject access requests.
   • The right to data portability.
   • The right to erase authentication data.
   • Documentation of all data processing activities.

"The GDPR imposes a wide range of requirements on organizations that collect or process personal data, including a requirement to comply with six key principles: transparency, fairness, and lawfulness; limiting processing to specified, explicit, and legitimate purposes; minimizing data collection and storage; ensuring accuracy; limiting storage; and ensuring security, integrity, and confidentiality".

Non-compliance with UK GDPR can lead to fines of up to £17.5 million or 4% of annual global turnover, whichever is higher.

Once you’ve met these requirements, proceed to configure MFA in Azure.

MFA Setup Steps in Azure

Turn On MFA

To enable MFA in Azure, use Conditional Access policies through the Azure portal. You'll need administrator privileges to proceed.

Here’s how to set it up:

1. Access the Admin Centre Log in to the Microsoft Entra admin centre. Ensure you have at least Conditional Access Administrator privileges to manage authentication settings.
2. Create an MFA Policy Navigate to Entra ID > Conditional Access > Policies, then click New policy. Name your policy clearly, such as "Global-MFA-Requirement".
3. Set Up Basic Settings Under Assignments, select the users or groups the policy will apply to. Starting with a test group is a good practice before rolling it out more broadly. Keep these points in mind:

   Setting Type	Recommended Configuration	Reason
   Include	Directory roles or test group	Begin with a small group, then expand
   Exclude	Emergency access accounts	Avoid accidental lockouts
   Target resources	All cloud apps	Ensures comprehensive coverage
   Conditions	Sign-in risk (if available)	Allows risk-based authentication

   Once you've configured these settings, move on to defining access rules that determine when MFA will be required.

Create Access Rules

Microsoft emphasises the importance of MFA:

"Your password doesn't matter, but MFA does! Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA." - Alex Weinert, Director of Identity Security at Microsoft

To create access rules:

1. Under Target resources, choose All resources.
2. In Access controls, select Grant access and enable Require multifactor authentication.
3. Start by setting the policy to Report-only mode. This helps you monitor its impact before enforcing it.

After setting up these rules, you can move on to configuring MFA for individual users.

Complete User Setup

The Microsoft Authenticator app is the preferred method for MFA, though SMS and voice call options are also supported.

Guide your users to:

• Download and install the Microsoft Authenticator app.
• Scan the QR code during the sign-in process.
• Set up a backup verification method.
• Refer to official documentation for help with specific scenarios.

Adding MFA to Current Systems

Step-by-Step Implementation

Introduce MFA in stages to minimise disruption and give teams time to adjust.

1. Assess Current Systems

Take stock of your applications and authentication methods. Identify which systems will need MFA, including any older or legacy systems that might require extra attention.

2. Create Migration Groups

Divide users into groups for a phased rollout. This ensures a smoother transition. Here's an example of how this could look:

3. Configure Authentication Methods

Set up various authentication options to meet the needs of different users, whether they prefer biometrics, app-based codes, or other methods.

Once you've outlined these steps, focus on preparing your team for the change.

Staff Training Guide

"Migrating to the new authentication methods in Entra ID is a strategic move that enhances security, improves user experience, and simplifies management."

Develop training materials tailored to your team’s needs:

• Quick-start guides: Include step-by-step instructions with screenshots.
• Video tutorials: Create short videos demonstrating common tasks.
• Help desk scripts: Equip support staff with troubleshooting steps.
• FAQ documents: Address frequent questions and concerns.

Encourage users to register themselves at https://myprofile.microsoft.com under the Security Info section.

After training, ensure the system is ready for all user groups.

Making MFA Work for Everyone

MFA should be accessible and easy to use for all:

• Visual impairments: Offer voice call authentication as an option.
• Limited mobility: Enable biometric authentication for convenience.
• Remote workers: Provide offline authentication choices.
• Non-technical staff: Use clear, visual setup guides.

For older systems, maintain compatibility by using the Network Policy Server (NPS) with the Microsoft Entra MFA extension.

Keep track of the rollout by gathering feedback and monitoring performance. Key metrics to monitor include:

• Authentication success rates
• Volume of help desk tickets
• User adoption levels
• Preferences for authentication methods

Fix Problems and Follow Standards

Common MFA Problems Fixed

Here are some typical issues with Azure MFA setups and how to address them:

Authentication failures often occur due to incorrect setup. Ensure phone numbers include the proper country code (e.g., +44 for the UK) and avoid using VOIP numbers.

"If you've mistakenly made many sign-in attempts, wait until you can try again, or use a different MFA method for sign-in." ― Microsoft Learn

If verification codes are not being received, consider the following steps:

• Check your junk email folder.
• Make sure mobile settings don’t block unknown numbers.
• Confirm your inbox has enough capacity to receive messages.
• Try connecting to a different network.

For users facing persistent blocks, navigate to AzureAD > Security > MFA > Block/Unblock Users. This is separate from the 'Block sign in' control.

Once these immediate issues are resolved, it’s important to prioritise ongoing maintenance to ensure MFA remains secure and functional.

MFA Maintenance Steps

Regular upkeep is crucial for keeping MFA effective. Pay attention to these areas:

From October 2024, Microsoft will require mandatory MFA for Azure portal access. To prepare:

• Use PowerShell to identify affected users.
• Transition automation accounts to managed identities.
• Update emergency access accounts with FIDO2 authentication.

Ensure your MFA practices align with UK-specific security regulations to meet compliance requirements.

UK Security Standards

Given that 32% of UK businesses report weekly cyber-attacks, a strong authentication setup is critical. Align your MFA configuration with these UK-specific recommendations:

• Enable logging for authentication events in line with UK data protection laws.
• Adjust system displays to reflect the DD/MM/YYYY date format.
• Activate biometric authentication options, as advised by the NCSC.
• Establish break glass accounts using FIDO2 security keys.

Starting 30th September 2025, legacy MFA policies will no longer be supported. Transition to Microsoft Entra's updated authentication methods well before this date to ensure compliance with UK security standards.

How to Set Up and Deploy MFA in Azure Using Conditional ...

Summary

Plan and manage your Azure MFA setup effectively to strengthen security across your organisation. This guide highlights key steps to help UK businesses meet security needs while adhering to data protection regulations.

Microsoft offers several features to enhance security for organisations building on existing compliance measures:

Key actions for organisations include:

• Monitoring MFA usage and registration through the Authentication Methods Activity dashboard.
• Setting up risk-based policies to require extra verification for unusual activity.
• Extending authentication log storage by configuring diagnostic settings.
• Encouraging staff to register multiple authentication methods for backup access.

Additionally, block outdated authentication methods and transition to modern protocols. Deploy Microsoft Authenticator and consider integrating FIDO2 keys for emergency access.

Server Consultancy, a prominent UK-based Azure consultancy, underscores the importance of identity management:

"Azure Identity Management for SMBs refers to Microsoft Azure's suite of cloud-based identity and access management solutions that allow businesses to manage user identities, secure access to resources, and ensure compliance with industry standards."

Follow these steps to strengthen your MFA strategy and improve security across your organisation.

FAQs

What challenges might businesses face when moving from legacy MFA to Azure Conditional Access policies?

Transitioning from legacy Multi-Factor Authentication (MFA) to Azure Conditional Access policies can present several challenges for businesses. Configuration complexity is a common issue, as setting up policies for diverse user groups and access needs requires careful planning to avoid misconfigurations that could lead to security gaps or access issues.

Another challenge is ensuring a smooth user experience. Overly strict policies can frustrate users with frequent authentication prompts, potentially affecting productivity. Additionally, older applications or systems using outdated authentication methods may not be compatible with Conditional Access, creating integration hurdles.

Businesses should also consider the need for ongoing policy management, as Conditional Access requires regular updates to adapt to new threats and organisational changes. Finally, the transition may require additional licensing (Azure AD Premium P1 or P2), which could increase costs for some organisations. Proper testing and a phased rollout can help mitigate these challenges and ensure a seamless transition.

How can UK businesses stay GDPR-compliant when setting up Azure Multi-Factor Authentication?

To ensure GDPR compliance when setting up Azure Multi-Factor Authentication (MFA), UK businesses should be aware of how and where Microsoft processes customer data. Microsoft stores data based on the address provided during subscription, with Azure MFA utilising datacentres in regions such as Europe, the United States, and Asia Pacific. Authentication methods like SMS and phone calls are routed through regional datacentres using global providers.

GDPR gives individuals rights over their personal data, including correcting, erasing, or restricting its processing. Using Microsoft Entra ID with Azure MFA supports a variety of secure authentication methods, helping businesses meet these compliance requirements. As Microsoft plans to make MFA mandatory for all Azure users by early 2025, UK organisations should act promptly to integrate MFA into their workflows while ensuring adherence to GDPR regulations.

What are the best ways to train employees to use Azure Multi-Factor Authentication effectively?

To train employees on using Azure Multi-Factor Authentication (MFA) effectively, start by creating a clear communication plan. Inform staff about the purpose of MFA, what steps they need to take, key dates for rollout, and where they can get help if needed.

Provide easy-to-follow instructions and resources, such as guides or visual aids, to ensure they understand how to set up and use MFA. Using real-world examples or scenarios can help make the process more relatable. Encourage feedback and address any concerns to ensure a smooth transition.

Lastly, offer ongoing support through a dedicated helpdesk or training sessions to assist with any issues and reinforce good security habits.

Related posts

• 5 Azure Security Best Practices for SMBs
• Ultimate Guide to Azure Resource Tagging
• Azure Backup Options for Small Businesses
• How to Optimise Azure AD Connect Performance