IBP‑IDENTITY – All Apps: [Require MFA] for [All Admin Roles]

✅ Require multi‑factor authentication (MFA) for all administrative roles across all Microsoft cloud applications.
➡️ Ensures that privileged identities cannot authenticate using password‑only methods, strengthening your Essential Eight Maturity Level 2–3 security baseline.

✅ Users: All administrative roles (130+ privileged roles)
🚫 Exclusions: One exception group (typically Break‑Glass / Emergency Access)

➡️ All privileged accounts must complete MFA, with only emergency access accounts excluded.

✅ Applications: All cloud applications
✅ Client types: Browser, mobile, desktop, CLI tools, PowerShell, modern auth, legacy protocols (where applicable)

➡️ MFA is required for all administrative actions, in every portal, tool, and app.

✅ MFA is required for every admin sign‑in
✅ Enforced using the built‑in Conditional Access MFA control
❌ No Authentication Strength policies applied (standard MFA only)

➡️ Password‑only or single‑factor admin sign‑ins are blocked.

This policy includes one of the most complete administrative role sets possible, covering:

This is a highly robust privileged identity control.

🚫 Device compliance
🚫 Location restrictions
🚫 Platform restrictions
🚫 User risk
🚫 Sign‑in risk
🚫 Session controls
🚫 Authentication Strength requirements

➡️ The control is singular and absolute: require MFA for every admin sign‑in.

✅ Enabled
➡️ Actively enforcing MFA for all administrative roles.

✅ Strongly aligns with Microsoft privileged access hardening
➡️ Meets Essential Eight Maturity Level 2 requirements for secure authentication
ℹ️ Forms a core foundation for Maturity Level 3, where phishing‑resistant MFA is expected.

This Conditional Access policy ensures that:

✅ Every administrator
✅ Accessing any Microsoft cloud application
✅ Must authenticate using multi‑factor authentication

This eliminates password‑only admin access, reduces privileged account compromise risk, and forms a core part of a secure identity perimeter.