This changes with version 1.1 of the Azure AD PowerShell module released earlier this month which provides support for MFA.
The steps to enable it are as follows:
- Enable MFA on the various tenants ()
- Download the latest AzureAD PowerShell modules that provide support for MFA (v 1.1 released 15. August 2016)
- Make sure you have the correct mobile phone number, alternate email and/or authenticator app installed (you typically want to have more than one MFA option available)
- Enable MFA on the user you want to protect with MFA
- Instruct the user to go to https://account.activedirectory.windowsazure.com/profile/ to verify their MFA settings (and SSPR if applicable)
Note: There are still some aspects in the Windows OS that are still not really aware of MFA, particulartly the Domain Join functionality. If have enabled MFA on the account you’re using for the domain join operation and you receive an erroneous “Incorrect Password” error (i.e. code 0x52e in the NetSetup.log debug log) during a domain join (and assuming you are actually typing in the correct password) then you may need to revert back to using a separate non-MFA account – at least for the domain join operation.
The Office 365 tenant/resource host (Exchange Online, SharePoint Online and Skype for Business Online) will need to be configured to accept a modern authentication connection.
Here is the per service state of modern authentication by default :
- Exchange Online – OFF by default.
- SharePoint Online – ON by default.
- Skype for Business Online – OFF by default.
Azure Active Directory PowerShell with Modern Authentication
Download Details: Azure Active Directory Connection
Azure AD PowerShell: Public Preview of support for Azure MFA + new Device Management Commands
How to install and configure Azure PowerShell
Skype for Business Online: Enable your tenant for modern authentication
Exchange Online: How to enable your tenant for modern authentication
The sign in experience with Azure Multi-Factor Authentication
Remote Desktop Gateway and Azure Multi-Factor Authentication Server using RADIUS
What are App Passwords in Azure Multi-Factor Authentication?