📝 Modified Documentation Files

MODIFIED docs/identity/authentication/concept-mandatory-multifactor-authentication.md

Modified by Justinha on Sep 17, 2025 3:49 PM
📖 View on learn.microsoft.com

+1 / -7 lines changed

Commit: removed images

Changes:

Before

After

>
>By postponing the start date of enforcement, you take extra risk because accounts that access Microsoft services like the Azure portal are highly valuable targets for threat actors. We recommend all tenants set up MFA now to secure cloud resources.
 
If you never previously signed in to the Azure portal with MFA, you're prompted to complete MFA to sign in, or postpone MFA enforcement. This screen is displayed only once. For more information about how to set up MFA, see [How to verify that users are set up for mandatory MFA](how-to-mandatory-multifactor-authentication.md).
 
:::image type="content" border="true" source="media/concept-mandatory-multifactor-authentication/mandatory.png" alt-text="Screenshot of prompt to confirm mandatory MFA."
 
If you select **Postpone MFA**, the date of MFA enforcement will be one month in the future, or Sept 30, 2025, whichever is earlier. After you sign in, you can change the date at [https://aka.ms/managemfaforazure](https://aka.ms/managemfaforazure). To confirm that you want to proceed with the postponement request, click **Confirm postponement**. A Global Administrator must [elevate access](https://aka.ms/enableelevatedaccess) to postpone the start date of MFA enforcement.  
 
:::image type="content" border="true" source="media/concept-mandatory-multifactor-authentication/postpone.png" alt-text="Screenshot of how to postpone mandatory MFA."
 
## Request more time to prepare for Phase 2 MFA enforcement

>
>By postponing the start date of enforcement, you take extra risk because accounts that access Microsoft services like the Azure portal are highly valuable targets for threat actors. We recommend all tenants set up MFA now to secure cloud resources.
 
Customers need to contact customer support to request postponement of Phase 1 MFA enforcement past September 30, 2025.
 
## Request more time to prepare for Phase 2 MFA enforcement

MODIFIED docs/identity/monitoring-health/concept-activity-log-schemas.md

Modified by egreenberg14 on Sep 17, 2025 5:25 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Clarify definition of ipAddress in activity log schemas

Changes:

Before

After

- `category`: Indicates which resource category that's targeted by the activity. For example: `UserManagement`, `GroupManagement`, `ApplicationManagement`, `RoleManagement`. For more information, see [Audit log activities](reference-audit-activities.md).
- `initiatedBy`: Indicates information about the user or app that initiated the activity.
- `targetResources`: Provides information on which resource was changed. Possible values include `User`, `Device`, `Directory`, `App`, `Role`, `Group`, `Policy` or `Other`.
- `ipAddress`: Found in the `initiatedBy` section, this is the OAuth client's IP address. The IP address is the TCP peer of the service's endpoint.
 
### Sign-in logs
 

- `category`: Indicates which resource category that's targeted by the activity. For example: `UserManagement`, `GroupManagement`, `ApplicationManagement`, `RoleManagement`. For more information, see [Audit log activities](reference-audit-activities.md).
- `initiatedBy`: Indicates information about the user or app that initiated the activity.
- `targetResources`: Provides information on which resource was changed. Possible values include `User`, `Device`, `Directory`, `App`, `Role`, `Group`, `Policy` or `Other`.
- `ipAddress`: Found in the `initiatedBy` section, this is the OAuth client's IP address. The IP address is the peer (directly connected client) of the service's endpoint.
 
### Sign-in logs
 

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files