Microsoft has announced that multi-factor authentication (MFA) will become mandatory for all users accessing the Microsoft 365 admin center, with enforcement beginning February 9, 2026.
While MFA rollout for the admin center started in February 2025, Microsoft will now fully block sign-ins for any admin accounts that do not have MFA enabled. This affects key administrative portals, including:
- portal.office.com/adminportal/home
- admin.cloud.microsoft
- admin.microsoft.com
Microsoft emphasized that enforcing MFA is a critical security control that significantly reduces the risk of account compromise, protecting organizations from phishing, credential stuffing, brute-force attacks, and password reuse.
📊 According to Microsoft research:
- 99.99% of MFA-protected accounts block hacking attempts
- MFA reduces account compromise risk by 98.56%, even when credentials are stolen
⚠️ What this means for organizations
- Admins without MFA will lose access once enforcement begins
- IT operations may be disrupted if MFA is not enabled in advance
- Global admins should configure MFA using Microsoft’s setup wizard or official documentation
This move follows Microsoft’s broader MFA enforcement strategy, including:
- MFA for Azure Portal sign-ins (since March 2025)
- MFA enforcement for Azure CLI, PowerShell, SDKs, and APIs (since October 2025)
🛠️ Action required:
If you manage Microsoft 365, verify MFA is enabled for all admin accounts now — before access is blocked.
