How do we handle MFA and Conditional Access during a Microsoft 365 migration?

Key facts

• MFA methods registered in one tenant do not carry over to another tenant.
• Conditional Access policies should be built and tested in report-only mode before the first wave.
• Keep at least two break-glass accounts excluded from Conditional Access and monitored.
• Migration tool accounts and app registrations need scoped exclusions, not blanket MFA removal.
• Day-one MFA registration is the biggest source of help desk calls in a tenant move.

Why identity is the risky part of a migration

A migration changes where people sign in, from which devices, and through which apps. Each change can trip a Conditional Access policy, block a migration tool or leave a gap attackers can use. Moving to a new tenant, or from Google Workspace or on-premises Exchange, also means users meet a new sign-in experience at the same time as new mail and files.

Getting identity right before the first wave keeps the cutover calm. Getting it wrong shows up as lockouts on Monday morning.

Plan MFA registration for each wave

In a tenant-to-tenant move, users get new accounts in the target, so their Microsoft Authenticator entries, phone methods and passkeys must be registered again. For moves into Microsoft 365 from other platforms, it may be the users' first time registering at all.

• Use a combined security information registration experience and give users a short guide with screenshots.
• Issue Temporary Access Pass codes so users can register passwordless methods without a password-plus-SMS step.
• Restrict where registration can happen with a Conditional Access policy on the register security information action, such as trusted locations or compliant devices.
• Schedule registration at the start of each wave, with help desk staff ready.
• Consider phishing-resistant methods such as passkeys in Microsoft Authenticator or FIDO2 keys for admins from day one.

Build Conditional Access in the target first

Design the Conditional Access set before migrating anyone. A typical baseline includes MFA for all users, stronger authentication for admins, blocking legacy authentication, device compliance requirements for sensitive apps and session controls for unmanaged devices. Conditional Access requires Entra ID P1 or higher licensing.

Turn new policies on in report-only mode, review sign-in logs and the What If tool, then enable them in stages. Target policies at groups so each wave can be added as it migrates.

Handle migration tools and service accounts

Migration tools usually connect through an Entra ID app registration with admin consent, which uses application permissions and is not subject to user MFA prompts. Some older tools still use a service account with a password. Where that is unavoidable, exclude only that account from the specific policies it breaks, restrict it by location, and remove the exclusion when the project ends.

Keep at least two cloud-only break-glass accounts excluded from Conditional Access, with strong credentials stored securely and sign-in alerts configured. These are for emergencies, not for running migrations.

Watch for these issues at cutover

Most problems on cutover day fall into a few patterns, and each can be checked ahead of time.

• Devices not yet enrolled in Intune failing compliance policies. Keep compliance in report-only until enrollment catches up.
• Shared mailboxes, scanners and apps using basic SMTP authentication blocked by legacy auth rules.
• Mobile mail apps without modern authentication support stopping sync.
• Users stuck in MFA loops because they have accounts in both tenants. Clear guidance on which account to use helps.
• Named locations missing new office IP ranges or VPN egress addresses.

How Accred Consulting approaches it

Accred Consulting designs Conditional Access and MFA as part of the migration plan, not after it. We build target policies in report-only mode, review sign-in logs with you, then enable them per wave. Users get registration guidance and Temporary Access Pass support at cutover. Our US-based specialists set scoped exclusions for migration tooling and remove them at handover. In one engagement we rolled out MFA and Conditional Access for a manufacturer of about 350 users in 6 weeks. Every engagement has a fixed price set after discovery.

Track record: 400+ client projects, 2,000+ migration workstreams and 150,000+ users migrated by a US-based team. Company facts · Case studies

Related questions