Microsoft 365 & Entra ID

Enable & Enforce Legacy Per-User MFA

Sets legacy per-user MFA to Enabled then Enforced for all member users. Useful for small tenants not yet on Conditional Access. Note: uses the legacy MSOnline module, which Microsoft is retiring.

Download .ps136 lines · PowerShell

Replace generic placeholder values (tenant, domain, secrets) for your own environment before running. Read it first and test safely.

# Connect to Microsoft Online Service (Azure AD)
Connect-MsolService

# Get all user accounts (excluding guest accounts)
$Users = Get-MsolUser -All | Where-Object {
    $_.UserType -eq 'Member' -and $_.UserPrincipalName -notlike '*#EXT#*'
}

# Check if there are valid users to configure MFA
if ($Users.Count -gt 0) {
    # Loop through each user to enable and enforce MFA
    foreach ($user in $Users) {
        # Enable MFA
        $EnableMFARequirement = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement
        $EnableMFARequirement.RelyingParty = "*"
        $EnableMFARequirement.State = "Enabled"

        # Apply "Enabled" requirement
        Set-MsolUser -UserPrincipalName $user.UserPrincipalName -StrongAuthenticationRequirements @($EnableMFARequirement)
        Write-Host -ForegroundColor Yellow "$($user.UserPrincipalName) MFA has been enabled."

        # Enforce MFA
        $EnforceMFARequirement = New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationRequirement
        $EnforceMFARequirement.RelyingParty = "*"
        $EnforceMFARequirement.State = "Enforced"

        # Apply "Enforced" requirement
        Set-MsolUser -UserPrincipalName $user.UserPrincipalName -StrongAuthenticationRequirements @($EnforceMFARequirement)
        Write-Host -ForegroundColor Green "$($user.UserPrincipalName) MFA has been enforced."
    }

    Write-Host -ForegroundColor Green "MFA has been enabled and enforced for all valid users!"
} else {
    Write-Host -ForegroundColor Yellow "No valid users were found to configure MFA."
}