Starting February 9, 2026, Microsoft will enforce multi-factor authentication (MFA) for all users who want to access the Microsoft 365 admin center. Administrators without MFA will face login blocks starting next month.
The measure is part of Microsoft’s strategy against credential-based attacks, which remain a significant attack vector. The company began a soft rollout in February last year, but starting next month, the requirement will be fully enforced for all tenants.
The enforcement focuses on three specific portals: portal.office.com/adminportal/home, admin.cloud.microsoft, and admin.microsoft.com. The admin center is used to manage tenants, users, and compliance processes. Without MFA, a stolen password gives attackers full access to sensitive company data.
High-privilege admin accounts are a popular target for ransomware campaigns that exploit Entra ID weaknesses. Microsoft emphasizes that more than 99.9 percent of compromised accounts lacked MFA, leaving them vulnerable to phishing and password reuse.
Legacy setups without tenant-level MFA can completely lock out global admins. Microsoft urges organizations to take action now using the MFA Wizard or the detailed guide at learn.microsoft.com.
Implementation and verification
Global admins can enable MFA organization-wide using methods such as Microsoft Authenticator push notifications, SMS codes, or hardware tokens. Individual users can check or add their methods via aka.ms/mfasetup.
Users with active MFA do not need to change anything, but they do need to audit accounts for completeness. This is especially true for hybrid environments that combine on-premises Active Directory with Entra ID.
The rollout is phased, but postponement increases the risk of downtime during critical tasks such as patching vulnerabilities or reviewing audit logs. Microsoft promises that users with properly configured MFA will not experience any downtime.