2

I've taken over as 'Admin' of an online SharePoint site in Office 365 with no background in SP administration. It's been requested that we enable multi-factor authentication (MFA) for only one site collection within our site. Does anyone know if this is possible, and if so, can you point me towards documentation on how to set it up? Based on my research, it is only possible to activate MFA per user for the whole O365 instance. https://social.technet.microsoft.com/wiki/contents/articles/36857.sharepoint-online-o365-set-up-multi-factor-authentication.aspx

2
  • 2
    you can't do MFA on a single site collection. Only on the tenant or MS account itself Nov 6, 2017 at 20:55
  • 1
    @Colbs please put this as an answer as it is the correct answer.
    – user6024
    Nov 7, 2017 at 15:54

3 Answers 3

2

You can't set Multi Factor Authentication per Site Collection, only on the tenant or the Microsoft account itself

Here is a technet article describing the process:

https://social.technet.microsoft.com/wiki/contents/articles/36857.sharepoint-online-o365-set-up-multi-factor-authentication.aspx

1
  • This answer was valid in the past, but that is no longer the case. This feature is in public preview now. You need to create a new context and assign that context to CA policy (CA needs as well user assignment so dynamic group can be used to encompass all users). Then you can assign context to an site using this pnp Set-SPOSite -Identity yourTenant.sharepoint.com/sites/siteName -ConditionalAccessPolicy AuthenticationContext -AuthenticationContextName "MFA_ON_SPO" Jul 19, 2021 at 12:26
0

Actually, with some customization, it is possible o have a single site OR just a library enforce MFA. We had that done for our Sharepoint online install. I am not the technologist to ask on "how", but it certainly is possible

0

It is possible (if you have Azure premium license) to set up MFA requirement for one specific site. We did it this way.

  1. Set up an context

  2. Set up an Conditional access policy that is using the context and have following groups.

    Include: AllTenantMembers (dynamic)

    Exclude: SP-ServiceAccount (Assigned Membership)

  3. Assign context to the site running this command.

    Set-SPOSite -Identity https://yourTenant.sharepoint.com/sites/siteName -ConditionalAccessPolicy AuthenticationContext -AuthenticationContextName "MFA_ON_SPO"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.