Making MFA mandatory in the Microsoft 365 Admin Center is, above all, a security improvement. However, an incomplete or rushed implementation can create real operational risks. Below are the main risks identified in midsize and large organizations, along with the mitigation strategies recommended by Microsoft and by identity governance best practices.
Risk 1: Administrative lockout (admin lockout)
As of February 9, 2026, any administrator who tries to sign in to the Microsoft 365 Admin Center without completing MFA will be blocked automatically, with no temporary bypass and no grace period. In environments with legacy administrative accounts, external (B2B) users or delegated access, this risk increases significantly.
Potential impact
- Inability to manage users, licenses or incidents
- Delays in critical processes (audits, financial closings, incident response)
- The need to escalate critical cases to Microsoft support
Recommended mitigation
- Inventory all accounts with access to the Admin Center (including B2B and historical accounts)
- Verify that each administrator has at least two MFA methods registered
- Test effective access to the three Admin Center endpoints before the deadline
Risk 2: Poorly protected or unusable "break-glass" accounts
Emergency (break-glass) accounts exist for recovery in case of failure; however, Microsoft confirms that these accounts will also be subject to mandatory MFA for access to the Admin Center. Poorly designed policies can leave the organization without any functional administrative access.
Potential impact
- Total tenant lockout
- Extreme operational risk during security incidents
- Complete dependence on external support
Recommended mitigation
- Maintain at least two break-glass accounts
- Protect them with phishing-resistant methods (for example, FIDO2 keys/passkeys)
- Carefully exclude them from overly restrictive risk policies, while keeping compensating controls in place.
Risk 3: Undetected impact on third-party access or B2B identities
Vendors, partners or external consultants who access the Admin Center through B2B are equally within the scope of the mandatory MFA requirement.
Potential impact
- Key third parties without access when support is needed
- Incidents caused by a lack of advance communication
- Impact on operational agreements or SLAs
Recommended mitigation
- Review B2B access with administrative roles
- Validate that external tenants comply with MFA
- Limit permissions: apply the principle of least privilege
