Require multifactor authentication for admin roles

Every account holding a privileged directory role (Global Administrator, Privileged Role Administrator, Security Administrator and similar) must be covered by a Conditional Access policy that enforces multifactor authentication.

Admin accounts are the highest-value target in your tenant. An administrator without MFA turns a single phished or sprayed password into full control of identity, mail and data. Microsoft and CISA both treat admin MFA as a baseline, non-negotiable control.

Create or extend a Conditional Access policy scoped to the privileged directory roles with grant control “Require multifactor authentication”. Exclude only one monitored break-glass account.