Enabling MFA in Microsoft 365

A stolen password is where most Microsoft 365 breaches begin. Multi-factor authentication (MFA) adds a second step, usually a notification in the Authenticator app. Even with your password, an attacker then can't sign in. Microsoft says MFA blocks more than 99% of account attacks. This article covers the three ways to turn on MFA and which one to pick.

Which option should you choose?

OptionLicenceBest for
Security defaultsFreeSmall organisations without Entra ID P1
Conditional AccessEntra ID P1 (in Business Premium, E3, E5 and more)Anyone who wants exceptions and rules per app or location
Per-user MFAFreeLegacy, no longer recommended

Turn on security defaults

Go to entra.microsoft.com > Identity > Overview > Properties > Manage security defaults and enable them. All users must then register the Authenticator app within 14 days. More in security defaults in Entra ID.

With Conditional Access

  1. Go to Protection > Conditional Access > Create new policy from templates.
  2. Choose the template Require multifactor authentication for all users.
  3. Exclude your break-glass emergency accounts, and keep those safe.
  4. Set the policy to Report-only first, check the sign-in logs, then turn it on.

Turn off security defaults once you use Conditional Access; the two don't work together.

Creating an MFA policy in Conditional Access

For the user

  1. Install Microsoft Authenticator on your smartphone.
  2. Go to aka.ms/mysecurityinfo > Add sign-in method > Authenticator app and scan the QR code.
  3. When signing in, type the number shown on screen into the app.
Registering the Authenticator app for MFA

Mandatory for admins

Microsoft is making MFA mandatory, step by step, for anyone signing in to the Azure portal, the Entra admin center, Intune and the Microsoft 365 admin center. Still have admins without MFA? Sort it out now.

One step further

Use passkeys or Windows Hello for Business: they resist phishing. Read passwordless sign-in. Old apps that don't support MFA? See app passwords. Users locked out? Set up self-service password reset.

Read also

Security defaults in Microsoft Entra ID: what they do and how to enable them
Enable passwordless sign-in in Microsoft 365 in 3 steps
Enable Self-Service Password Reset (SSPR) in Microsoft Entra ID

Nederlandstalige versie: Multi-factor authenticatie (MFA) activeren in Microsoft 365

share on LinkedIn ☕ buy me a coffee

More in English

▸App passwords in Microsoft 365: create, delete and replace themWhen do app passwords still work in Microsoft 365? Create or delete one, what the end of SMTP AUTH basic… ▸Assign admin roles in Microsoft 365Which admin roles exist in Microsoft 365, who gets which one, and how to assign them in the admin center.… ▸How to enable and use Windows LAPS with Microsoft Entra IDGive every Windows device a unique local admin password with Windows LAPS, Microsoft Entra and Intune.… ▸Secure score in Microsoft Defender for CloudView and raise your Azure environment's secure score in Microsoft Defender for Cloud, and learn how it…