Mandatory Microsoft MFA Changes: Why Moving to the New Authentication Methods Policy Can’t Wait

Australia, Sep 15, 2025

Microsoft is enforcing big changes to how organisations manage Multi-Factor Authentication (MFA) and Self-Service Password Reset (SSPR). The clock is ticking if you’re still relying on legacy MFA and SSPR policies.  

From 30th September 2025, you can no longer manage authentication methods using these legacy policies. Without proper oversight, you're on a path to losing control, leaving your organisation vulnerable to a host of serious security and operational risks. 

Additionally, starting October 1st, 2025, Microsoft will begin Phase 2 enforcement for MFA at the Azure Resource Manager (ARM) layer. 

This overrides Conditional Access Policy Exemptions and enforces the requirement of MFA when users perform Azure or Entra resource‐management operations via any client

 

What’s Changing 

Deprecation of Legacy MFA & SSPR Policies 

Microsoft is deprecating the old MFA and SSPR policies in favour of the unified Authentication Methods policy in Entra ID. 

This new policy centralises the management of all authentication methods, including: 

  • Microsoft Authenticator push notifications
  • FIDO2 security keys
  • SMS and voice calls
  • Temporary Access Pass (TAP)
  • Passwordless sign-in options 

Unlike the fragmented legacy setup, everything is managed in one place, with consistent targeting and reporting. 
 
Phase 2 of Azure Mandatory MFA 

Phase 2 enforcement for MFA at the Azure Resource Manager (ARM) layer includes requiring MFA when users perform resource‐management operations via any client, e.g., Azure CLI, PowerShell, REST APIs, SDKs, Infrastructure-as-Code (IaC) tools, mobile apps, etc. 

What Happens If You Do Nothing? 

If your organisation ignores this change and stays on legacy policies past September 30th, 2025: 

  • No ability to change MFA or SSPR settings
  • You’ll lose control to enable/disable methods like SMS or Authenticator.
  • Increased security risk
  • Legacy MFA configurations are more rigid and can’t keep up with modern threats. Attackers are increasingly targeting weak methods like SMS, and without policy control, you won’t be able to phase them out.
  • Operational headaches
  • Your helpdesk will lose the ability to manage authentication for impacted staff. They won’t be able to assign new methods like FIDO2 keys, causing friction for everyone.
  • Forced migration
  • When Microsoft fully transitions to modern policies, it will stop respecting legacy policy settings. If you’re not prepared, you’ll face a last-minute scramble to avoid service disruption.
  • Service Disruption
  • From October 1st, when Microsoft rolls out MFA Enforcement Phase 2, you will no longer be able to use common exceptions, such as for service accounts. This means some third-party tooling, integration, and other applications could stop working if it was previously exempt. 

 

What You Should Do Now 

Audit your current authentication setup 

  • Identify who is still relying on SMS or other legacy authentication methods
  • Track who is currently using an Authenticator App
  • Confirm that App Passwords have been completely phased out
  • Review and ideally eliminate location-based IP address exceptions, particularly in preparation for a transition to Conditional Access
  • Note any exemptions to MFA requirements, with a special focus on service accounts and other non-human identities 

Enable and configure the Authentication Methods policy 

  • Mirror your existing settings first; the default policies may not match your legacy settings
  • Plan to expand to add new secure methods
  • Set Migration status to “Complete” to enforce the new policy 

Ensure there are no MFA Exemptions allowed 

  • With all users, including service accounts, adhering to MFA already, you can rest assured that all your existing software, tooling, integration, and other applications are compatible and should not be interrupted by any mandatory enforcement. 

Communicate to users 

  • Moving from SMS to Authenticator, or introducing passkeys, requires user buy-in. Start training early. 

Strengthen your authentication methods 

  • With the new policies now in place and organisation communications released, plan to phase out the legacy weaker authentication methods.

Speak with the Logicalis team today and let us take the stress out of modernising your identity security. 

Topic

Related Insights