Monitor-only vs enforced

Every resource is in one of two modes, controlled by its Require MFA on setting.

Monitor-only (Require MFA on: none)

The agent is fully installed and working, but sign-ins are never prompted for a second factor. You still get:

• Sign-in events in the audit log (who, where, when, from which IP)
• Attack detection and — if enabled — Shield blocking
• Inventory (OS, IPs, listening ports, firewall state)

Monitor-only is the observe-first option: roll the agent out across a fleet, watch real sign-in traffic, link people calmly — and only then enforce. Nothing can lock anyone out in monitor-only mode.

(Note the actual defaults on a fresh resource: Require MFA on is both, but Enforce is off — so the password-only fallback keeps everyone safe until you deliberately enforce. Switch Require MFA on to none if you want pure monitor-only.)

Enforced (console, rdp, or both)

Sign-ins of the selected type ask for the person’s second factor. A correct Windows password alone is no longer enough.

Two related settings matter here:

• Enforce — when on, password-only fallback at the sign-in screen is disabled, so MFA cannot be bypassed by picking another credential tile.
• Fail-mode — what happens if the machine can’t complete MFA (for example, no network): open allows the sign-in (default, anti-lockout), closed denies it. See sign-in policies.

Recommended rollout

1. Install everywhere (Enforce is off by default — or set monitor-only for pure observation).
2. Link people and let them enroll.
3. Watch the audit log for a few days.
4. Turn Enforce on (and set Require MFA on as needed) where appropriate.

The panel marks monitor-only resources clearly, so an “installed but not protecting” machine is never mistaken for a protected one.