How to Turn On MFA for Students in Microsoft Entra ID, Step by Step

← Back to Blog

Turning on MFA for students in Microsoft Entra ID is not hard. Doing it without a week of angry teachers takes a little more planning. This is the order we follow, from licensing to the day you flip the policy on.

The steps assume you are using an external MFA provider for students, since the built-in Entra methods mostly assume a phone. If you have not decided on a factor yet, start with our student MFA guide.

Before you start

• Microsoft Entra ID P1. You need Conditional Access to give students their own MFA policy. Many districts have P1 through Microsoft 365 Education A3.
• Security defaults off. Security defaults cannot be scoped to groups and registers everyone with the Authenticator app. If it is still on, plan to replace it with Conditional Access policies before you go further.
• The right roles. Authentication Policy Administrator can set up the method. Granting the provider's admin consent takes a Privileged Role Administrator.
• A pilot group. Pick one building or grade band and put those students in a security group. If your SIS sync fills in grade or school attributes, a dynamic group keeps itself current.
• Break-glass accounts. Confirm your emergency access accounts and know where they are. You will exclude them from every policy below.
• Windows 11 for new devices. Microsoft notes that identities using only external MFA fail during Windows 10 out-of-box setup and that Windows 10 will not be supported for this. If students set up their own Windows devices, check this first.

Step 1: Add the external MFA method

In the Microsoft Entra admin center, go to Entra ID > Authentication methods and choose Add external MFA. Your provider gives you three values to paste in:

• Client ID
• Discovery endpoint
• App ID

Pick the name carefully. Students see it in the sign-in screen, it has to be unique, and you cannot change it later.

Next, request admin consent for the provider's app. Until consent is granted, every sign-in that uses the method fails, so do not enable it before consent goes through.

Step 2: Scope it to the pilot group

Open the method and include only your pilot group. Students outside that group will not see the method at all.

One detail that matters: if other methods like the Authenticator app are also enabled for those students, Entra will show those first and students have to pick the external one. If the external method is the only one enabled for them, Entra sends them straight to the provider. For younger grades, that difference is worth a lot.

Step 3: Register the students

Microsoft requires users to have the external method registered before they can use it. There are three ways to do that:

• Admin registration. In the admin center, open a user, go to Authentication methods, and add the external authentication method. At student scale you will want to script this with Microsoft Graph.
• Registration at sign-in. Students in scope can be walked through setup by the registration wizard when they sign in.
• Security info page. Students can add it themselves at mysignins.microsoft.com.

For anyone below middle school, admin registration is the path that keeps kids from getting stuck. Ask your provider what happens on their side during registration and what you need to send them.

Step 4: Create the Conditional Access policy in report-only mode

Go to Entra ID > Conditional Access and create a new policy:

• Users: include the pilot group. Exclude your break-glass accounts.
• Target resources: all resources, unless you have a reason to start narrower.
• Grant: require multifactor authentication.
• Enable policy: Report-only.

Report-only evaluates the policy at every sign-in and logs what would have happened, without prompting anyone. Students sign in exactly as they did yesterday.

Step 5: Read the logs for a couple of weeks

Open a few sign-ins in the sign-in logs and check the Report-only tab. "User action required" means the student would have been asked for the second factor. "Not applied" means the policy did not match, which is how you catch students who are missing from the group or service accounts you forgot about.

If you send sign-in logs to a Log Analytics workspace, the Conditional Access insights workbook gives you the same picture across the whole pilot.

Step 6: Decide how often students are asked

Entra's default is a rolling 90-day window, so on a student's own device they will rarely see a prompt. Shared devices are different. Microsoft's guidance for shared devices is to turn off persistent browser sessions and the "Stay signed in?" prompt, and to disable the old "remember MFA on trusted devices" setting before you use sign-in frequency controls. Set these on purpose rather than finding out from a teacher.

Step 7: Turn it on and expand

Tell the pilot teachers what students will see and who to call. Then switch the policy from Report-only to On. Watch sign-ins and support requests for a few weeks. When the numbers look boring, add the next building or grade to the group.

If something goes wrong, set the policy to Off. Students are back to password-only sign-in right away, and you can work the problem without pressure.