diff --git a/website/docs/docs/cloud/manage-access/mfa.md b/website/docs/docs/cloud/manage-access/mfa.md
index a06251e646..e07d4e60ff 100644
--- a/website/docs/docs/cloud/manage-access/mfa.md
+++ b/website/docs/docs/cloud/manage-access/mfa.md
@@ -7,6 +7,13 @@ sidebar: null
 
 # Multi-factor authentication
 
+:::Important
+
+
+dbt Cloud enforces multi-factor authentication (MFA) for all users with username and password credentials. Users who have not MFA enabled will see a notification asking them to configure one of the supported methods when they log in. If they do not, they will have to configure MFA on the next login or be unable to access dbt Cloud.
+
+:::
+
 dbt Cloud provides multiple options for multi-factor authentication (MFA). MFA provides an additional layer of security to username and password logins for Developer and Team plan accounts. The available MFA methods are:
 
 - SMS verification code (US-based phone numbers only)
diff --git a/website/docs/docs/dbt-versions/release-notes.md b/website/docs/docs/dbt-versions/release-notes.md
index 2fdb020777..499c6010c2 100644
--- a/website/docs/docs/dbt-versions/release-notes.md
+++ b/website/docs/docs/dbt-versions/release-notes.md
@@ -20,6 +20,7 @@ Release notes are grouped by month for both multi-tenant and virtual private clo
 
 ## October 2024
  
+- **Behavior change:** [Multi-factor authentication](/docs/cloud/manage-acces/mfa) is now enforced on all users who log in with username and password credentials. 
 - **Fix:** Previously, POST requests to the Jobs API with invalid `cron` strings would return HTTP response status code 500s but would update the underlying entity. Now, POST requests to the Jobs API with invalid `cron` strings will result in status code 400s, without the underlying entity being updated.
 - **Fix:** Fixed an issue where the `Source` view page in dbt Explorer did not correctly display source freshness status if older than 30 days.
 - **Fix:** The UI now indicates when the description of a model is inherited from a catalog comment.