A stolen password is where most Microsoft 365 breaches begin. Multi-factor authentication (MFA) adds a second step, usually a notification in the Authenticator app. Even with your password, an attacker then can't sign in. Microsoft says MFA blocks more than 99% of account attacks. This article covers the ways to turn on MFA, which one to pick and how to roll it out without a flood of helpdesk calls.
Which option should you choose?
| Option | Licence | Best for |
|---|---|---|
| Security defaults | Free | Small organisations without Entra ID P1 |
| Conditional Access | Entra ID P1 (in Business Premium, E3, E5 and more) | Anyone who wants exceptions and rules per app or location |
| Per-user MFA | Free | Legacy, no longer recommended |
Still using per-user MFA? Move to one of the other two and then switch the per-user setting off, or users will get unpredictable prompts.
Prepare
- Create two break-glass emergency accounts: cloud-only accounts with the Global Administrator role, a long password and ideally a FIDO2 key. Store the details safely and offline.
- Tell users in advance what changes, when, and where to get help.
- Turn on self-service password reset. Users then register their methods for MFA and password reset in one go.
Turn on security defaults
Go to entra.microsoft.com > Entra ID > Overview > Properties > Manage security defaults and enable them. In older versions of the menu you'll see Identity instead of Entra ID. All users must then register the Authenticator app within 14 days, and admins must use MFA at every sign-in. Legacy protocols such as POP and IMAP with basic authentication are blocked. More in security defaults in Entra ID.
With Conditional Access
- Go to Entra ID > Conditional Access (formerly under Protection) > Create new policy from templates.
- Choose the template Require multifactor authentication for all users.
- Exclude your break-glass accounts.
- Set the policy to Report-only first, review the sign-in logs for a week, then turn it on.
Turn off security defaults once you use Conditional Access; the two don't work together. The advantage of Conditional Access: you can, for example, prompt less often on managed devices and always for sign-ins from outside.
For the user
- Install Microsoft Authenticator on your smartphone.
- Go to aka.ms/mysecurityinfo > Add sign-in method > Authenticator app and scan the QR code.
- Add a second method right away, such as a phone number, in case you lose your device.
- When signing in, type the number shown on screen into the app. Never enter a number when you aren't signing in yourself.
Not every method is equally strong
- Passkeys, FIDO2 keys and Windows Hello for Business: phishing-resistant. The best choice.
- Authenticator with number matching: good and easy to use.
- SMS and voice call: better than nothing, but vulnerable to SIM swapping. Use them only as a backup.
Mandatory for admins
Microsoft has made MFA mandatory for signing in to the Azure portal, the Entra admin center, the Intune admin center and the Microsoft 365 admin center. A second phase extends it to Azure CLI, Azure PowerShell and other management tools. Still have admin or service accounts without MFA? Fix it now. For scripts, a workload identity with a certificate is the better route.
Common problems
- User has a new phone. An admin opens the user in the Entra admin center, goes to Authentication methods and selects Require re-register multifactor authentication, or the user signs in with the backup method.
- An old app keeps asking for a password. It doesn't support modern authentication. Look for an update or replacement; app passwords are only a temporary workaround.
- Too many prompts. Check whether per-user MFA is still on alongside your policy.
FAQ
Does MFA cost extra?
No, security defaults and the Authenticator app are free. Conditional Access requires Entra ID P1.
What's the next step?
Passwordless sign-in with passkeys. Read passwordless sign-in.
Nederlandstalige versie: Multi-factor authenticatie (MFA) activeren in Microsoft 365