Multi-factor authentication in Azure - Commands & Configuration

Introduction

Multi-factor authentication adds an extra step to signing in to your Azure account. It helps protect your account by requiring you to prove who you are with something you know and something you have, like a phone or app.

When you want to protect your Azure account from unauthorized access even if your password is stolen

When you manage sensitive data or resources in Azure and need stronger security

When your organization requires extra verification for all users signing in

When you want to reduce the risk of account hacking from phishing or stolen credentials

When you want to comply with security policies that require multi-factor authentication

Commands

This command signs you into your Azure account using the Azure CLI. It starts the process where you will be prompted for multi-factor authentication if it is enabled.

Terminal

az login

Expected Output

To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code ABCD1234 to authenticate.



You have logged in. Your subscription is: Example Subscription

This command checks the details of a user in Azure Active Directory to confirm their account exists and to view their authentication methods.

Terminal

az ad user show --id [e-mail]

Expected Output

{

  "accountEnabled": true,

  "displayName": "Example User",

  "id": "12345678-90ab-cdef-1234-567890abcdef",

  "userPrincipalName": "[e-mail]"

}

→

--id - Specifies the user principal name or object ID of the user to show

This command displays the current multi-factor authentication policy settings for your Azure Active Directory tenant.

Terminal

az ad mfa policy show

Expected Output

{

  "state": "enabled",

  "enforcementState": "enforced",

  "methods": ["phoneAppNotification", "phoneAppOTP", "textMessage"]

}

This command enables and enforces multi-factor authentication for all users in your Azure Active Directory tenant.

Terminal

az ad mfa policy update --state enabled --enforcementState enforced

Expected Output

{

  "state": "enabled",

  "enforcementState": "enforced"

}



Multi-factor authentication policy updated successfully.

→

--state - Sets the MFA policy state to enabled or disabled

→

--enforcementState - Sets whether MFA enforcement is active or not

Key Concept

If you remember nothing else from this pattern, remember: Multi-factor authentication adds a second step to sign-in to protect your Azure account from unauthorized access.

Common Mistakes

Trying to sign in without completing the MFA prompt

The sign-in will fail because Azure requires the second verification step when MFA is enabled

Complete the MFA prompt by entering the code sent to your phone or approving the notification in your authenticator app

Assuming MFA is enabled without checking the policy

Users may think their accounts are protected when MFA is not actually enforced

Use 'az ad mfa policy show' to verify the MFA policy state and enforcement

Not updating the MFA policy after creating it

The policy changes won't take effect until you enable and enforce MFA

Run 'az ad mfa policy update --state enabled --enforcementState enforced' to activate MFA

Summary

Use 'az login' to sign in and trigger multi-factor authentication if enabled.

Check user details with 'az ad user show' to confirm account information.

View MFA policy settings with 'az ad mfa policy show' to understand current enforcement.

Enable and enforce MFA with 'az ad mfa policy update' to protect all users.

Practice

1. What is the main purpose of Multi-factor Authentication (MFA) in Azure?

easy

A. To provide free cloud storage

B. To speed up the login process

C. To allow users to reset their passwords automatically

D. To add an extra step to verify user identity for better security

Solution

1. Step 1: Understand MFA concept

   MFA requires users to provide two or more verification methods to prove their identity.

2. Step 2: Identify MFA's main goal

   This extra verification step improves security by making unauthorized access harder.

3. Final Answer:

   To add an extra step to verify user identity for better security -> Option D

4. Quick Check:

   MFA = extra verification step [OK]

Hint: MFA means more than one way to prove who you are [OK]

Common Mistakes:

• Thinking MFA speeds up login
• Confusing MFA with password reset
• Assuming MFA provides storage

2. Which of the following is the correct PowerShell command to enable MFA for a user in Azure AD?

easy

A. Set-MsolUser -UserPrincipalName [e-mail] -StrongAuthenticationRequirements @(@{RelyingParty="*";State="Enabled"})

B. Enable-MsolUser -UserPrincipalName [e-mail] -StrongAuthenticationRequirements @()

C. New-MsolUser -UserPrincipalName [e-mail] -EnableMFA $true

D. Add-MsolUser -UserPrincipalName [e-mail] -MFAEnabled

Solution

1. Step 1: Recall correct MFA enabling syntax

   In Azure AD PowerShell, enabling MFA uses Set-MsolUser with StrongAuthenticationRequirements set to enabled.

2. Step 2: Match command to syntax

   Set-MsolUser -UserPrincipalName [e-mail] -StrongAuthenticationRequirements @(@{RelyingParty="*";State="Enabled"}) correctly uses Set-MsolUser with StrongAuthenticationRequirements array containing State="Enabled".

3. Final Answer:

   Set-MsolUser -UserPrincipalName [e-mail] -StrongAuthenticationRequirements @(@{RelyingParty="*";State="Enabled"}) -> Option A

4. Quick Check:

   Enable MFA = Set-MsolUser + StrongAuthenticationRequirements enabled [OK]

Hint: Look for Set-MsolUser with StrongAuthenticationRequirements enabled [OK]

Common Mistakes:

• Using Enable-MsolUser which does not exist
• Confusing New-MsolUser with enabling MFA
• Using Add-MsolUser which is invalid

3. Consider this Azure AD MFA policy snippet:

{"state": "enabled", "methods": ["phoneAppNotification", "sms"]}

What happens when a user tries to sign in?

medium

A. User must use a hardware token only

B. User can sign in without any additional verification

C. User must verify identity using either phone app notification or SMS code

D. User is blocked from signing in

Solution

1. Step 1: Analyze MFA policy state

   The policy state is "enabled", so MFA is active and required.

2. Step 2: Check allowed verification methods

   Methods include phone app notification and SMS, so user can use either to verify.

3. Final Answer:

   User must verify identity using either phone app notification or SMS code -> Option C

4. Quick Check:

   MFA enabled means verification required via allowed methods [OK]

Hint: Enabled MFA means user must verify by one allowed method [OK]

Common Mistakes:

• Thinking user can skip verification
• Assuming user is blocked
• Believing only hardware tokens work

4. You configured MFA for a user but they report they are not prompted for the second factor. What is the most likely cause?

medium

A. The user is excluded from MFA in the conditional access policy

B. The user has not logged in for 30 days

C. The user's password is expired

D. The user is using a supported MFA method

Solution

1. Step 1: Understand why MFA prompt might be skipped

   If a user is excluded in conditional access policies, MFA won't be enforced for them.

2. Step 2: Evaluate other options

   Login inactivity or password expiry do not disable MFA prompts; supported methods enable MFA.

3. Final Answer:

   The user is excluded from MFA in the conditional access policy -> Option A

4. Quick Check:

   Exclusion in policy = no MFA prompt [OK]

Hint: Check if user is excluded in conditional access policies [OK]

Common Mistakes:

• Assuming password expiry disables MFA
• Thinking inactivity disables MFA
• Confusing supported methods with disabling MFA

5. You want to enforce MFA only when users access sensitive Azure resources from outside your corporate network. Which Azure feature should you use to achieve this?

hard

A. Enable MFA for all users unconditionally

B. Conditional Access policies with location-based conditions

C. Azure AD Identity Protection without conditions

D. Use Azure Firewall to block all external access

Solution

1. Step 1: Identify feature for conditional MFA enforcement

   Conditional Access policies allow setting MFA requirements based on conditions like user location.

2. Step 2: Match requirement to feature

   Location-based conditions in Conditional Access enable MFA only outside corporate network.

3. Step 3: Evaluate other options

   Identity Protection without conditions cannot target location; unconditional MFA applies everywhere; firewall blocks access but does not enforce MFA.

4. Final Answer:

   Conditional Access policies with location-based conditions -> Option B

5. Quick Check:

   Conditional Access + location = targeted MFA [OK]

Hint: Use Conditional Access with location rules for targeted MFA [OK]

Common Mistakes:

• Using unconditional MFA for all users
• Relying on Identity Protection without conditions
• Blocking access instead of enforcing MFA