Guide · Security
Microsoft now requires a second factor to reach its administrative portals. Right, and also how tenants discover the six-year-old script that runs as a user. The five things that break, and the order to fix them in.
By Alex Makey · 6 September 2026 · 7 min read · Verified against Microsoft documentation, September 2026
Microsoft has been enforcing multi-factor authentication for administrative portals in stages, and by 2026 the enforcement reaches the Microsoft 365 admin centre itself: sign in without MFA and you do not get in. This is right, and it is also how a surprising number of tenants discover the service account that has been running a nightly job for six years. Here is what changes, what breaks, and what to do about each.
Sign-in to the Azure portal, the Entra admin centre, the Intune admin centre and the Microsoft 365 admin centre requires a second factor, regardless of Conditional Access and regardless of security defaults. Microsoft applies it at the service; you cannot opt out, only postpone within the window Microsoft allowed, and that window has been closing through 2025 and 2026.
It applies to every account that signs in to those portals, including accounts that are not administrators but happen to visit. It applies to break-glass accounts. It applies to the account the reseller uses under delegated administration.
Scripts and automation that sign in as a user. A PowerShell job running under a named account with a stored password, connecting to Exchange Online or Graph. It has no way to complete MFA and it stops. These are usually the oldest, least documented processes in the tenant.
Shared administrator accounts. One account, one password, four people. MFA needs a second factor that belongs to a person; a shared phone in a drawer is the failure mode.
Break-glass accounts with no second factor. Excluded from Conditional Access by design, and therefore never registered. They now need one, and it should not be a phone.
Partner and reseller access where the partner’s staff have not enrolled.
Users who never registered because they never needed to. The first time they are prompted is when they need in urgently.
Automation: move it off user accounts. Register an application in Entra ID, grant it the specific Graph or Exchange permissions the job needs, authenticate with a certificate rather than a secret, and run the job as the application. For Exchange Online this is app-only authentication with a certificate; for Graph it is client credentials. This is more work than the rest of the list combined and it is the one that matters, because a job that stops silently is a job nobody notices until the report is missing.
Shared administrator accounts: retire them. One person, one account, one role. Where a shared account is genuinely needed — a vendor, a helpdesk — use Privileged Identity Management to grant the role just in time to a named person instead.
Break-glass: a FIDO2 security key per account, stored with the password. Not SMS, not an authenticator app on someone’s phone. The full setup is here.
Partner access: ask. A partner that has not enrolled its own staff in MFA is telling you something.
Everyone else: a registration campaign before the deadline, not after. Entra ID has one built in — it nudges users to register the Authenticator app at sign-in over a period of weeks, so nobody meets the requirement for the first time on a Monday morning.
It is not a reason to disable Conditional Access or security defaults, which do more than portal MFA. It is not satisfied by SMS, which Microsoft is steadily retiring as a method. And it is not optional: an administrator who has not registered a method by the enforcement date is locked out of the portal until they do, and can only register by signing in — which is the loop that ends in a support ticket.
One email a month, at most
Postmortems, timelines, licensing changes that cost people money. If a month has nothing worth your time, you hear nothing.
Please enter a work email address.
Done. Unsubscribe by replying to any email; we will not argue.
Related questions
Yes. Microsoft has enforced multi-factor authentication for its administrative portals in stages, reaching the Microsoft 365 admin centre in 2026. It applies at the service, regardless of Conditional Access, to every account that signs in to those portals.
Scripts running under user accounts with stored passwords, shared administrator accounts, break-glass accounts with no second factor, partner staff who have not enrolled, and users who never registered a method.
Move it off user accounts. Register an application in Entra ID with the specific permissions the job needs, authenticate with a certificate, and run the job as the application using app-only authentication.
A FIDO2 security key stored with the password. Not SMS and not an authenticator app on someone’s personal phone. The key satisfies MFA without depending on Conditional Access.
No. Microsoft allowed postponement within a window that has been closing through 2025 and 2026. After the enforcement date an account without a registered method cannot sign in to the portal.
Rather not do this yourself?
Describe the situation and you get back a sequence, an honest view of what will be slow, and a fixed price — usually within one business day. Or ask one question and get one answer.