This guide explains enforced MFA in Microsoft 365, how it differs from the enabled state, and what Microsoft recommends instead.
If you manage Microsoft 365, you have probably seen users listed as “Disabled”, “Enabled” or “Enforced” for multi-factor authentication (MFA) and wondered what the difference is. The labels are confusing, and getting them wrong can leave accounts less protected than you think. Here is what each state means, and what Microsoft recommends instead.
The three per-user MFA states
| State | What it means |
|---|---|
| Disabled | The user is not using per-user MFA. This is the default for new users. |
| Enabled | The user has been switched on for MFA but has not finished registering. They are prompted to register the next time they sign in. Until they do, they can still sign in with just a password in some situations. |
| Enforced | The user has registered an MFA method and must use it every time they sign in. Apps that do not support MFA stop working until they use an app password or are replaced. |
In practice, a user normally moves from Disabled to Enabled when you turn MFA on, and to Enforced automatically once they complete registration. If you leave users in the Enabled state, you may think they are protected when they are not yet.
Why per-user MFA is not the best option
Per-user MFA is a blunt tool. It cannot tell the difference between a sign-in from your office and one from another country, it needs manual work every time someone joins, and it makes exceptions difficult. It is now considered the legacy way to do MFA.
Security defaults
Security defaults are a free, one-switch option that turns on a baseline of protections, including requiring all users to register for MFA and blocking legacy authentication. They suit very small organisations with simple needs, but they offer little control or flexibility.
Conditional Access
Conditional Access is the recommended approach for most businesses. You write policies such as “require MFA for everyone, all apps” or “require a compliant device for access to company data”, and apply exceptions precisely. It supports report-only testing, stronger authentication requirements for administrators and risk-based rules. It requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium.
What we recommend
- Use Conditional Access to require MFA for all users and cloud apps.
- Set the per-user MFA state back to Disabled once Conditional Access covers those users, so the two do not clash.
- Block legacy authentication.
- Move administrators and sensitive roles to phishing-resistant methods.
- Keep a pair of tested emergency accounts excluded from the policy.
Final thoughts
Key takeaways
- Enabled means MFA has been switched on for a user, but they have not finished registering. Enforced means they have registered and must use MFA at every sign-in.
- Users left in the enabled state may be less protected than you think, because they can still sign in with just a password in some situations.
- Per-user MFA is the legacy approach. Microsoft recommends Conditional Access, or security defaults for very small tenants.
Enforced MFA: frequently asked questions
What is the difference between enabled and enforced MFA?
Enabled means the user has been switched on for MFA but has not finished registering, so they are prompted to register at their next sign-in. Enforced means they have registered an MFA method and must use it every time they sign in.
Why are some users still enabled instead of enforced?
A user normally moves from enabled to enforced automatically once they complete registration. Users who stay in the enabled state have not finished registering, so it is worth finding them and following up.
Should we use per-user MFA or Conditional Access?
Conditional Access. Per-user MFA cannot tell a sign-in from your office apart from one in another country, needs manual work whenever someone joins, and makes exceptions difficult. Microsoft recommends Conditional Access, or security defaults for very small tenants.
Related reading: Microsoft Entra ID consulting. For Microsoft or government guidance, see Microsoft guidance on per-user MFA states.
“Enabled” does not mean protected and “Enforced” is not a strategy. A modern setup uses Conditional Access with phishing-resistant methods where it matters most. If you would like your Microsoft 365 MFA setup reviewed, Total Solutions IT can check it and fix the gaps. Call 02 6061 4222.
