Multi-Factor Authentication also known as MFA is a security mechanism where computer users have to input 2 evidence of authentication such as a password and OTP (One time password). In this era of technology, security is critical and almost all big companies provide MFA for their IT services.

In this article, we will learn how to set up MFA for a Microsoft Entra ID (formerly Azure Active Directory) user and what options are available in MFA settings.

Before you start: The steps below enable MFA per-user, the legacy method described in this post's original version. Microsoft's current recommendation is to enforce MFA through a Conditional Access policy instead (requires Microsoft Entra ID P1 or P2), or via Security Defaults if you're on the Free tier. Per-user MFA and Conditional Access should not be mixed -- if you use Conditional Access, leave per-user MFA state alone. See Microsoft's guidance on enabling per-user MFA for the current caveats. Also note that management of MFA authentication methods (which verification options are allowed) moved out of the legacy per-user/per-tenant MFA service settings and into the unified Authentication methods policy after Microsoft retired the legacy settings on September 30, 2025.

How to Setup Per-User MFA in Microsoft Entra ID

Step 1: Sign in to the Microsoft Entra admin center

Go to https://entra.microsoft.com and sign in with at least an Authentication Policy Administrator account. (The classic Azure Portal Azure AD blades used in earlier versions of this guide have been superseded by the Entra admin center.)

Multi Factor Authentication

Step 2: Browse to Users

Go to Identity > Users > All users.

MFA Users

Step 3: Open Per-user MFA

Select Per-user MFA from the toolbar. It opens the per-user multifactor authentication management page in a new browser tab.

MFA Link

Step 4: Find and Enable User

Use the search box to find the user you want to enable, select the account, then choose Enable MFA.

MFA Settings

Step 5: Confirm Enable

Confirm the change in the pop-up that appears. The user's state moves to Enabled and automatically becomes Enforced once they complete authentication method registration at their next sign-in.

enable multi-factor auth

Step 6: Choose Authentication Methods

Users register their own verification methods at sign-in, or you can review/require methods centrally under Protection > Authentication methods > Policies in the Entra admin center. The two most common options end users pick between are:

  1. Phone authentication (SMS or voice call) -- a code is sent by text message or call.

MFA Phone

  1. Microsoft Authenticator app -- push notification or code-based approval from the Authenticator app on the user's phone.

MFA APP

Microsoft now recommends the Authenticator app (and passwordless methods like passkeys/FIDO2) as the primary method, with SMS/voice treated as a weaker fallback rather than a first choice -- SMS is more susceptible to SIM-swap and interception attacks.

How to get a List of Users with MFA Status

The MSOnline and AzureAD PowerShell modules (including Get-MsolUser) were retired by Microsoft in 2025 and no longer work. Use the Microsoft Graph PowerShell SDK instead:

Connect-MgGraph -Scopes "User.Read.All","UserAuthenticationMethod.Read.All"

Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,AccountEnabled | ForEach-Object {
    $mfaState = (Invoke-MgGraphRequest -Method GET -Uri "/beta/users/$($_.Id)/authentication/requirements").perUserMfaState
    [PSCustomObject]@{
        DisplayName       = $_.DisplayName
        UserPrincipalName = $_.UserPrincipalName
        AccountEnabled    = $_.AccountEnabled
        "MFA Status"      = if ($mfaState) { $mfaState } else { "disabled" }
    }
} | Export-Csv -Path "C:\scripts\mfa.csv" -NoTypeInformation

This reports the per-user MFA state (disabled, enabled, or enforced) for every user in the tenant. If your organization enforces MFA through Conditional Access rather than per-user state, this report won't reflect that -- check sign-in logs or the Conditional Access What If tool instead to confirm coverage.

Related Reading