Hi All,
Just a quick observation, it looks like last night a pair of Azure Policies were added to the Tenant Root Group of my tenant. I checked a few other tenants, some have them and some don't. Based on the names and descriptions, I assume this is Microsoft preparing for some upcoming changes, and is rolling this out.
Policy 1:
Name: Microsoft Azure Multi Factor Authentication Enforcement for Resource Write Actions
Policy: Multi Factor Authentication Enforcement - Write
Type: SystemHidden
Name: sys.mfa-delete
Created: Oct 20, 2026 (about 15 hours ago)
Non-Compliance Msg: You are receiving this error because you tried to create, update or delete Azure resources without authenticating through MFA. User accounts must be authenticated through MFA to manage your resources. To resolve this error, go to https://aka.ms/MFAforAzure
Policy 2:
Name: Microsoft Azure Multi Factor Authentication Enforcement for Resource Delete Actions
Policy: Multi Factor Authentication Enforcement - Delete
Type: SystemHidden
Name: sys.mfa-write
Created: Oct 20, 2026 (about 15 hours ago)
Non-Compliance Msg: You are receiving this error because you tried to create, update or delete Azure resources without authenticating through MFA. User accounts must be authenticated through MFA to manage your resources. To resolve this error, go to https://aka.ms/MFAforAzure
The policies are not visible in the azure portal, they are hidden, but you can see them with an ARG query from Graph Explorer:
PolicyResources
| where type =~ 'microsoft.authorization/policyassignments'
| extend assignmentScope = tostring(properties.scope)
| where assignmentScope =~ strcat('/providers/Microsoft.Management/managementGroups/', tenantId)
| extend displayName = tostring(properties.displayName)
| extend description = tostring(properties.description)
| extend policyDefinitionId = tostring(properties.policyDefinitionId)
| extend enforcementMode = tostring(properties.enforcementMode)
| extend parameters = properties.parameters
| extend nonComplianceMessages = properties.nonComplianceMessages
| extend notScopes = properties.notScopes
| extend createdBy = tostring(properties.metadata.createdBy)
| extend createdOn = tostring(properties.metadata.createdOn)
| extend updatedBy = tostring(properties.metadata.updatedBy)
| extend updatedOn = tostring(properties.metadata.updatedOn)
| extend assignedBy = tostring(properties.metadata.assignedBy)
| project id, name, type, location, subscriptionId, tenantId,
assignmentScope, displayName, description, policyDefinitionId,
enforcementMode, parameters, nonComplianceMessages, notScopes,
identity, createdBy, createdOn, updatedBy, updatedOn, assignedBy
| order by id asc
There's an equivalent activity log entry for each from the principle:
Microsoft Authorization System Policy
d2381cb8-26aa-404d-9218-550726c79b07
Just curious if anyone else noticed this or got these polices. I have alerts setup for when any policy changes occur in my environment, and got an email last night on it. Thought it was interesting, so decided to make a post about it.