Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model. After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication. To achieve this, the Per Enabled User setting must be set for the usage model. Solution: You reconfigure the existing usage model via the Azure CLI. Does the solution meet the goal?

The terms "Per Authentication" and "Per Enabled User" refer to the billing models for an

Azure Multi-Factor Authentication (MFA) Provider. Reconfiguring the usage model from

"Per Authentication" to "Per Enabled User" via the Azure CLI primarily changes how the

company is billed for MFA services. This action, by itself, does not enable or enforce MFA

for the new Azure AD users. To ensure employees use MFA, their individual MFA status

must be set to 'Enabled' or 'Enforced' (for per-user MFA), or they must be included in a

Conditional Access policy that mandates MFA. The proposed solution only addresses the

billing/usage model, not the actual enablement of MFA for the users.

1. Microsoft Learn: "How to get Azure AD Multi-Factor Authentication"

URL: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfalicensing

Section: "Azure AD Multi-Factor Authentication provider"

Quote/Content: This section explains that an MFA provider "offers per-user or per-

authentication billing," confirming these terms relate to billing/consumption models, not

direct user enablement mechanisms.

2. Microsoft Learn: "Enable per-user Azure AD Multi-Factor Authentication to secure sign-in

events"

URL: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfauserstates

Content: This document details the process of changing user MFA states (Disabled,

Enabled, Enforced), which is the necessary step for per-user MFA enablement, distinct from

changing a billing model.

3. Microsoft Learn: "Plan an Azure AD Multi-Factor Authentication deployment"

URL: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfadeploy

Content: This guide discusses various ways to enable MFA, primarily focusing on

Conditional Access policies and per-user MFA enablement, neither of which is achieved by

solely changing a billing model.