Lab: Microsoft Entra ID MFA and conditional access basics

Aim and what you need

The aim is to require multi-factor authentication (MFA) for a test user with a conditional access (CA) policy in Microsoft Entra ID, the identity service behind Microsoft 365 and Azure. CA is an if-then engine: if a sign-in matches the conditions, then grant access, demand MFA or block.

• A separate test tenant, never your employer's or school's production tenant. A free Azure account creates one for you.
• Entra ID P1 licensing for CA. A time-limited trial is usually enough; set a calendar reminder for when it ends.
• An authenticator app on your phone and a second browser profile for the test user.
• Optional: PowerShell 7 with the Microsoft Graph module, or the Azure CLI (command-line interface).

Warning: protect the tenant's own global administrator with MFA before anything else, and keep a spending budget on the subscription (see the budget alerts lab).

Steps

1. Sign in to the Entra admin centre as global administrator and register MFA for that account.
2. Create a break-glass (emergency access) account with a long random password stored offline. You will exclude it from every policy so a mistake cannot lock you out.
3. Create the test user and a group for the pilot.
4. CA cannot run alongside security defaults. Under Entra ID, Overview, Properties, turn security defaults off only once you are ready to create your own policy straight away.
5. Go to Protection, Conditional Access, New policy. Name it LAB-Require-MFA-Pilot. Users: include the pilot group, exclude the break-glass account. Target resources: all cloud apps. Grant: require multifactor authentication. Enable policy: Report-only.
6. Sign in as the test user in the second browser profile, then review the sign-in log entry and its Report-only tab.
7. When the result looks right, switch the policy to On, sign in again and register the authenticator app when asked.

The same objects can be created from the command line:

az login
az ad user create --display-name "Lab User" --user-principal-name labuser@<yourtenant>.onmicrosoft.com --password "<temporary-password>" --force-change-password-next-sign-in true
az ad group create --display-name "LAB-MFA-Pilot" --mail-nickname labmfapilot
az ad group member add --group "LAB-MFA-Pilot" --member-id <user-object-id>

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "Policy.Read.All","Policy.ReadWrite.ConditionalAccess","AuditLog.Read.All"
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName, State

How to verify

Open Entra ID, Monitoring, Sign-in logs, and select the test user's latest sign-in. The Conditional Access tab should show your policy as Success once MFA was completed, or Report-only: Failure if it would have blocked access. The What If tool on the Conditional Access page lets you test a user and app combination without signing in. Finally, sign in as the break-glass account and confirm the policy shows as Not applied.

Troubleshooting and clean-up

• Policy not listed in the log: check the user is really in the pilot group and the policy is saved.
• Locked out: sign in with the break-glass account and set the policy to Off. This is exactly why you made it.
• Cannot turn on the policy: security defaults are still enabled, or the licence trial has ended.
• Prompted too often: look at session controls such as sign-in frequency.

To clean up, set the policy to Off and delete it, remove the test user and group, cancel any trial you do not want to renew, and if the tenant was only for this lab, delete any Azure subscription in it. Write down what you did: a short change log is good practice at work and a handy portfolio item.

Tip: in real organisations, CA changes go through change control and always start in report-only mode for a few days.