Microsoft Mandates Multi-Factor Authentication for Microsoft 365 Admin Center Access

Microsoft is enforcing mandatory multi-factor authentication (MFA) for all users accessing the Microsoft 365 admin center, with the policy taking full effect on February 9, 2026. This move follows a phased rollout that began in February 2025 and targets key administrative portals, including portal.office.com/adminportal/home, admin.cloud.microsoft, and admin.microsoft.com. Administrators without MFA enabled will be blocked from signing in, and Microsoft urges organizations to act immediately to avoid disruptions to IT operations and administrative functions. The enforcement is part of Microsoft's broader strategy to combat credential-based attacks, which remain a leading cause of security breaches.

By requiring MFA, Microsoft aims to significantly reduce the risk of account compromise, prevent unauthorized access, and safeguard sensitive data managed through the admin center. The company highlights that MFA is a critical defense against phishing, credential stuffing, brute-force attacks, and password reuse. Administrators are advised to use the MFA Wizard or official documentation to configure organization-wide MFA, while individual users can verify or add authentication methods through the designated setup portal. This policy aligns with Microsoft's ongoing efforts to strengthen identity security, including previous enforcement of MFA for Azure Portal sign-ins across all tenants.