Introduction
In today’s cloud‑driven world, passwords alone are no longer enough to protect user identities. Microsoft Entra Multifactor Authentication (MFA) adds an essential layer of security by requiring users to verify their identity through multiple factors — something they know (password), something they have (device or code), or something they are (biometric).
This exercise walks you through enabling and configuring MFA in Microsoft Entra ID. You’ll learn how to manage per‑user MFA settings, review service configurations, and set account lockout thresholds to prevent unauthorized access. These are foundational skills for any cloud engineer responsible for securing identities and access in enterprise environments.
Exercise - Perform basic Multifactor Authentication tasks
In this exercise you will explore the MFA setup process and configure a basic MFA deployment.
Task 1 - Enable / Disable Per-user MFA settings
- Open the Microsoft Entra admin center at https://entra.microsoft.com.
- Log in using the credentials for your tenant.
- From the menu on the left, open the Identity submenu
- Select Users and then select All users.
- Look at the menu on the top of the new screen and find Per-user MFA.
- Select Per-user MFA.
- Put a mark in the box next to Bhogeswar Kalita.
- Select Enable MFA from the top of the list.
- Read the message box that pops up.
Note - This is a manual URL that you can email to the user, if you want to let them know to set up MFA. - Select Enable button.
- Note that after a few seconds enforced shows up next to Bhogeswar’s name.
Task 2 - Review the Service settings for MFA
- Open the Microsoft Entra admin center at https://entra.microsoft.com.
- Log in using the credentials for your tenant.
- From the menu on the left, open the Identity submenu.
- Select Users and then select All users.
- Select Per-user MFA item.
- Select Service settings.
- Review the settings you can configure:
| Setting | What it is for |
|---|---|
| App passwords | Some legacy applications do not support MFA. This setting allows users to continue using those apps by generating app-specific passwords. |
| Trusted IPs | Define specific IP address ranges that are always considered safe. Users signing in from these ranges can bypass MFA requirements. |
| Verification options | Choose which verification methods (e.g., SMS, email, authenticator app, phone call) are available for users as their second factor of authentication. |
| Remember multifactor authentication on trusted device | Allow users on trusted devices (such as company-managed laptops) to retain their MFA-approved status for a specified number of days, reducing repeated prompts. |
- Select the Discard button if you made any changes.
- This is one method of configuring MFA for your users.
Task 3 - View MFA account lockout settings
- Open the Microsoft Entra admin center at https://entra.microsoft.com.
- Log in using the credentials for your tenant.
- From the menu on the left, open the Protection submenu.
- Scroll to the bottom of the list and select Show more.
- Select Multifactor authentication from the menu.
- Select Account lockout from the menu.
| Field | Value |
|---|---|
| Number of MFA denials to trigger account lockout | 3 |
| Minutes until account lockout counter is reset | 180 |
| Minutes until account is automatically unblocked | 15 |
Select the Save option at the top of your screen.
Review some of the other configuration options you have on MFA like:
- Fraud alert
- Block / unblock users
- Notifications
Summary
Task 1 – Enable/Disable Per-user MFA
Navigate to Microsoft Entra admin center → Identity → Users → All users → Per-user MFA.
Select a user (e.g., Bhogeswar Kalita), enable MFA, and confirm.
The user’s MFA status changes to enforced once enabled.
Task 2 – Review MFA Service Settings
Options include:
App passwords: Allow legacy apps without MFA support.
Trusted IPs: Define safe IP ranges to bypass MFA.
Verification options: Choose allowed second-factor methods.
Remember MFA on trusted devices: Retain MFA approval for a set number of days on managed devices.
Task 3 – Configure MFA Account Lockout
Navigate to Protection → Multifactor authentication → Account lockout.
Suggested values:
3 denials trigger lockout.
Counter resets after 180 minutes.
Account automatically unblocks after 15 minutes.
Additional options: fraud alerts, blocking/unblocking users, notifications.
Conclusion
This exercise demonstrates how I set up and managed basic MFA deployment in Microsoft Entra. It covers enabling MFA for individual users, adjusting service-wide settings to balance usability and security, and configuring account lockout rules to protect against repeated failed attempts.
Takeaway Points
MFA can be enforced per user, giving granular control.
Service settings allow flexibility for legacy apps, trusted networks, and device policies.
Account lockout rules are essential to prevent brute-force attacks while minimizing disruption for legitimate users.
Administrators should regularly review fraud alerts, user blocks, and notifications to maintain a secure environment.
Top comments (0)