How to disable new "Multifactor authentication for Microsoft partners and vendors" policy on DEMO TENNANT?

Nikolay Belykh 50

17.03.2024 on all "demo" tenants (CDX) https://cdx.transform.microsoft.com/the MFA policy was enforced for the fake "Contoso" organization. Not for the partner org, but for the demo tenants!!!

This is really troublesome for me as a partner, and makes those demo tenants much less useful!
Is there a way to change this back and disable MFA, so that customers can "play" with the demo?

Once again, the policy talks about "partner" tenants, which actually makes sense; but what is applied to is also the "demo" tenants, which does not. And you can't remove it, it's enforced :(

Neil Wilson 0 Reputation points

2024-04-12T20:11:17.9966667+00:00

We have the same problem on our demo systems. We share access to our demo systems with our pre-sales consultants who login as one of the demo users in the CDX tenant so that they can showcase our integrations with Microsoft products. All our demo systems with Microsoft integrations have been affected by this policy change and rendered useless, so we are now scrambling to replace every CDX tenant used in our demo systems.

I understand the requirement to increase security - i just wish we had been warned of the impending change, or provided with a solution for our use case.

Accepted answer

Vasil Michev 95,666 Reputation points MVP

2024-03-19T19:07:40.1066667+00:00

Any "demo" tenant is owned by Microsoft, as clearly stated in their "terms of use", which was also updated to mention the requirement for MFA. So I'm afraid this is the new behavior going forward.

You can open a support case with the CDX team if you think you might be able to change their mind.
Please sign in to rate this answer.
Nikolay Belykh 50 Reputation points

2024-03-19T19:45:12.0066667+00:00

This would be really sad. I hope somebody from Microsoft will read this and apply some common sense to it to revert this policy back for the DEMO tenants.

Joseph Farrar 50 Reputation points

2024-03-20T06:19:35.84+00:00

Here is a bigger issue. MFA was turned on for all of my demo CDX tenants. However, one of them is expired and I'm trying to remove it. I am not allowed to delete an expired CDX tenant now because of MFA???

"There was an issue deleting M365x823........ . Please change the Admin user's password back to the default password and disable MFA if it has been activated then try to delete the tenant again."

I tried to Disable MFA, doesn't work. This is an annoying problem that the CDX team needs to fix. I submitted a support ticket.

Demo Tenant 0 Reputation points

2024-03-27T16:14:10.8233333+00:00

We have the same issue, basically can't remove expired demo tenants due to enforced MFA. I manually deleted the tenant directly through Azure AD, then tried again to remove from CDX portal.

I get a different error message now "Issue deleting M365....Contact Support" and so I have done just that.

Hopefully this problem is resolved soon

Antonio Gatti 0 Reputation points

2024-04-12T06:31:36.54+00:00

Please provide clear instruction on HOW TO DELETE THE TENANT, my environment are expired and I cannot use CDX at all.
Sign in to comment

1 additional answer

Givary-MSFT 28,321 Reputation points Microsoft Employee

2024-03-20T06:35:41.8333333+00:00

@Nikolay Belykh Thank you for reaching out to us, reached out to CDX team to confirm this change, here is the response which I got:

MFA is being enforced and required for all CDX demo to enhance platform security posture. This is not something our team disable or change, as it is part of a global change to Microsoft demo tenants. Additionally, please note, customer access to demo tenants as described in the post is against CDX Terms of Use.

Let me know if you have any further questions, feel free to post back or raised a ticket a with CDX team directly as they don't work/reply on QnA platform.
Please sign in to rate this answer.
Joseph Farrar 50 Reputation points

2024-03-20T06:38:02.72+00:00

Givary, issue I'm facing right now that I'm sure everyone else is. There is no way to delete an expired demo CDX tenant now because MFA is on.

"There was an issue deleting M365x823........ . Please change the Admin user's password back to the default password and disable MFA if it has been activated then try to delete the tenant again."

Joachim Henrard 40 Reputation points

2024-03-25T00:14:46+00:00

Not a problem for me. for having MFA turned on. But I'm unable to exclude my resource accounts that are been used by the MTR rooms. That aren't able to support MFA seen the shared nature. Can this be fixed asap ... or can someone explain me how I can accomplish that.

As you can see I can alter the first policy . .. but the second one I can't alter at all ...

I've tried to change multiple things here ... but all ending up with the same error.

Blocking me to use my MTR rooms and demo.

Looking forward to your insigths and guidance

Joseph Farrar 50 Reputation points

2024-03-27T16:54:56.8766667+00:00

@Joachim Henrard yeah that is also an issue. From my perspective/opinion they need to make the following adjustments with MFA being turned on

The Global Admin account should be excluded from MFA so that deleting of an expired CDX tenant works

They should allowed a service / resource account to be excluded from the MFA policy

June Twain 1 Reputation point

2024-04-23T08:42:19.9633333+00:00

This made me struggle a lot when trying to demo passwordless features, as well as plenty other Conditional Access scenarios. This policy should only be enforced to users with privileged roles.
Sign in to comment