MFA enforcement for Partner Center APIs

Multifactor authentication (MFA) enforcement for Partner Center APIs: Take action immediately.

Impacted audience

Partners using app+user authentication for Partner Center API integrations

Microsoft implemented progressive enforcement of multifactor authentication (MFA) across all Partner Center app+user APIs via incremental traffic exposure. This builds on the MFA requirements already enforced for the Partner Center portal and extends the same level of protection to API-based access.

If your systems aren't yet fully configured for MFA, you are at risk of service disruption. Set up your users with MFA and make sure all app+user API integrations are updated to support MFA as soon as possible.

Any app+user API calls made without a valid MFA claim may be blocked and return a 401 response with error code 900421.

If your business relies on automation for provisioning, billing, customer management, or support operations, treat this as a top-tier reliability requirement, not a background security item.

Delaying action continues to result in blocked API calls and operational disruption.

Next steps

• Inventory app+user API integrations across your tools and partner-facing experiences.
• Validate token acquisition flows and confirm a valid MFA claim is included end-to-end.
• Test in sandbox and production-aligned environments where applicable, then monitor for 401 and 900421 patterns to catch gaps early.
• View this video to learn how to identify non-MFA users and applications using Microsoft Entra sign-in logs.