DOWO
Home Documentation Support Start a project

Multi-Factor Authentication (MFA)

Last updated 2 months ago

MFA is enforced by Microsoft Entra, not by this plugin. This is by design: Microsoft handles the entire authentication experience — password, MFA prompt, passwordless sign-in, device compliance, risk evaluation — and only returns a signed token to WordPress once all requirements are satisfied.

This means the plugin holds no MFA secrets and never sees the second factor. It simply trusts the result of the Microsoft sign-in.

How it fits together

  1. The user clicks Sign in with Microsoft.
  2. WordPress redirects them to Microsoft Entra.
  3. Entra authenticates the user. If a Conditional Access policy requires MFA, Microsoft prompts for it at this step.
  4. Only after all policies are met does Entra redirect back to WordPress with a signed ID token.
  5. WordPress validates the token and signs the user in.

Because step 3 is owned by Microsoft, MFA, passwordless, and risk-based policies all work without any further configuration in WordPress.

Requiring MFA with Conditional Access

Conditional Access requires Microsoft Entra ID P1 or higher. Tenants with security defaults enabled already require MFA for all users and need no extra policy.

To require MFA specifically for the WordPress application:

  1. In the Entra admin center, go to Protection → Conditional Access → Policies.
  2. Click New policy and give it a name, e.g. WordPress – Require MFA.
  3. Users: select the users or groups it applies to (e.g. all users, or just those assigned to the app).
  4. Target resources → Cloud apps: select your WordPress app registration.
  5. Grant: choose Grant access and tick Require multifactor authentication.
  6. Set Enable policy to On and Create.

Test with a pilot group first (use Report-only mode) before rolling out broadly.

Verifying MFA is being enforced

  1. Sign in to WordPress via the Microsoft button using an account in scope of the policy.
  2. You should be prompted for a second factor during the Microsoft step.
  3. In the Entra admin center, Monitoring → Sign-in logs shows the authentication, the applied Conditional Access policy, and the MFA result.

Important: local login bypasses Entra MFA

The hidden local login form authenticates against WordPress directly and does not involve Entra, so Entra MFA does not apply to it. Keep local accounts to a minimum, use strong passwords, and consider a dedicated MFA plugin for those accounts. See LOCAL-LOGIN.md.