How to Turn On Multi-Factor Authentication for Microsoft 365

The short answer: If you don't have Microsoft Entra ID P1, turn on security defaults in the Microsoft Entra admin center; it makes every user register for multi-factor authentication. If you do have P1, which is included in Microsoft 365 Business Premium, use Conditional Access policies instead, because they give you more control.

Why MFA comes first

Many Microsoft 365 account takeovers start with a stolen or guessed password. Multi-factor authentication (MFA) means a password alone isn't enough to sign in, which makes it one of the most effective security controls you can turn on. Microsoft also now requires MFA to sign in to its admin portals, so your administrators will need it regardless.

Before you start

• You need an administrator account with permission to change these settings, such as Security Administrator.
• Tell your users what's changing and when, and how to install the Microsoft Authenticator app on their phones.

Option 1: security defaults (no extra licence)

Security defaults are a free set of settings that Microsoft maintains for every tenant. They require all users to register for MFA, require administrators to use MFA, prompt users for MFA when Microsoft judges it necessary, and block older sign-in methods that can't use MFA.

1. Sign in to the Microsoft Entra admin center at entra.microsoft.com.
2. Open the tenant's Overview, then Properties.
3. Select Manage security defaults, set it to Enabled, and save.

Microsoft moves admin menus from time to time. If you can't find the setting, search the admin center for "security defaults".

Users are asked to register for MFA the next time they sign in, and have 14 days to do so. Security defaults apply to everyone: you can't exclude individual accounts or set different rules for different groups. For that, you need Conditional Access.

Option 2: Conditional Access (Microsoft Entra ID P1)

Conditional Access lets you write your own sign-in rules. It needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, E3 and E5. Common starting policies are:

• Require MFA for all users.
• Require MFA for administrator roles on every sign-in.
• Block legacy authentication.

Microsoft provides templates for these in the Conditional Access section of the Entra admin center. Security defaults and Conditional Access can't be used together, so turn security defaults off when you switch. Start each new policy in report-only mode to see who it would affect before you enforce it, and keep an emergency access administrator account, stored securely, so a misconfigured policy can't lock you out of your own tenant.

After you turn it on

• Check the sign-in logs for users who haven't registered yet.
• Prefer the Microsoft Authenticator app to text messages where you can.
• Review the setup when people join or leave and when you add new apps.

Need help?

Apaxon can help you plan and roll out MFA as part of its cybersecurity services. Contact our team to talk it through.