Does the "Enable multifactor authentication by 21 Sep 2026" apply to terraform updates via SP

No. Terraform updates that use a service principal are not affected in the same way as user sign-ins.

The mandatory MFA enforcement applies to users signing in to Azure management surfaces and tools such as the Azure portal, Azure CLI, Azure PowerShell, SDKs, REST APIs, and IaC tools including Terraform when those actions are performed through a user identity.

For automation, the recommended approach is to use a workload identity such as a service principal or managed identity instead of a user-based account. Terraform supports authenticating with a service principal by setting provider credentials such as:

$env:ARM_CLIENT_ID="<service_principal_app_id>"
$env:ARM_SUBSCRIPTION_ID="<azure_subscription_id>"
$env:ARM_TENANT_ID="<azure_subscription_tenant_id>"
$env:ARM_CLIENT_SECRET="<service_principal_password>"

Then verify them with:

gci env:ARM_*

Important: storing credentials directly in a Terraform configuration file is not advisable because clear-text credentials can be viewed by non-trusted individuals.

If the Terraform automation is currently using a user-based account instead of a service principal, that user-based automation will be affected by MFA enforcement and should be migrated to a service principal or managed identity.

References:

• Mandatory multifactor authentication for Azure and admin portals
• Authenticate to Azure with service principal
• Comparing Terraform and Bicep
• MFA for admins in azure/entra is already enabled via conditional access. Does MS also force normal users to use MFA? - Microsoft Q&A
• MFA for Microsoft Entra user accounts employed as service accounts - Microsoft Q&A