Turn on multifactor authentication (MFA) for every Microsoft 365 account in your company

A single leaked password is enough for an outsider to read an employee's mailbox and download their OneDrive files. Multifactor authentication (MFA) adds a confirmation step on the phone, so the password alone no longer gets anyone in. Microsoft says that requiring MFA together with blocking legacy sign-in protocols stops more than 99.9% of common identity attacks.

This guide is for whoever looks after Microsoft 365 at a small company: turn MFA on for everyone, get staff registered, and handle the usual problems.

Choose how to turn it on: security defaults or Conditional Access

Microsoft 365 offers three ways to turn on MFA. Most small companies should start with security defaults.

A few things to know first:

• Security defaults and Conditional Access are mutually exclusive. If your organization still has even one Conditional Access policy, in any state (on, off or report-only), you can't turn security defaults on.
• Tenants created on or after 22 October 2019 may have security defaults already on.
• Microsoft also turns security defaults on automatically for tenants that have no Conditional Access policies, no premium licenses and no legacy sign-in clients in use, and emails the admins about it. If staff suddenly get asked to install Authenticator, check the admin mailbox first.

Before you turn it on: five things to check

1. Devices and apps that use legacy sign-in will be blocked. Security defaults blocks every sign-in request made over an older protocol: apps without modern authentication (Office 2010, for example) and mail apps using IMAP, POP3 or SMTP. The usual suspects: printers and scanners that email scans (scan to email) and old software that sends mail with a hard-coded password. List them first.
2. Admins should sign in right after you turn it on to register their authentication methods. Microsoft recommends keeping admin accounts separate from everyday work accounts.
3. Warn your staff in advance. Since 29 July 2024, Microsoft no longer gives users a 14-day window to postpone: whoever is asked to register for MFA has to do it during that sign-in.
4. Turn off legacy per-user MFA if you ever used it. Security defaults and Conditional Access both require it to be off for your users. Organizations that signed up after 2019 usually never had it on.
5. Security defaults can't be piloted by group. Some IT service providers (4iT in Australia, for one) share their experience of doing admins first and then staff in groups — but grouping is only possible with Conditional Access. Security defaults applies to the whole tenant the moment it's on, so steps 1 and 3 matter even more.

Turn on security defaults step by step

Microsoft Entra documentation asks for at least the Conditional Access Administrator role; the Microsoft 365 admin documentation lists Security Administrator or Global Administrator. Whoever created the tenant is a Global Administrator by default.

Microsoft Entra admin center with the toggle to turn on security defaults

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Overview > the Properties tab (some versions of the interface say Identity > Overview).
3. Scroll to the Security defaults section at the bottom of the tab and read the status line:
   • Your organization is protected by security defaults. — already on, nothing to do.
   • Your organization is not protected by security defaults. — off; continue with step 4.
   • A message saying your organization uses Conditional Access — you can't turn on security defaults; see "When to move to Conditional Access".
4. Select Manage security defaults.
5. In the Security defaults box, choose Enabled, then Save.

Microsoft recommends revoking existing sign-in sessions straight after, so people who were already signed in also have to sign in again and register for MFA. You do this with the Revoke-MgUserSignInSession cmdlet in Microsoft Graph PowerShell.

Staff register Microsoft Authenticator

With security defaults, users register using Microsoft Authenticator notifications. Once registered, they can approve with a notification or use a code from Authenticator; codes from any other OATH TOTP authenticator app are accepted too.

Approve sign-in request screen asking for the number shown in the Authenticator app

Send your staff these steps:

1. Install Microsoft Authenticator on your phone (App Store or Google Play).
2. On a computer, open mysignins.microsoft.com/security-info and sign in with your work account. If the sign-in screen asks for more security information on its own, just follow it — the steps are the same.
3. Select Add sign-in method > Microsoft Authenticator > Add, then Next to show a QR code.
4. On your phone, open Authenticator, tap + > Work or school account > Scan a QR code, and scan the code on the computer screen.
5. Can't scan it? On the computer select Can't scan the image; on the phone choose Enter code manually and type in the code shown.

From then on, when confirmation is needed, the sign-in screen shows a number that you type into Authenticator. This defeats attacks that keep firing approval requests until a tired user taps approve.

A point IT service providers raise often: if each person has exactly one registered phone, losing it means a call to the admin. Encourage anyone who can to add a backup method while they're registering.

While you use security defaults, don't switch off any methods in the MFA service settings — Microsoft warns this can lock you out of your own tenant.

After you turn it on: what changes

• Admins must complete MFA every time they sign in. The list covers 16 roles, including Global Administrator, Security Administrator, Exchange Administrator, SharePoint Administrator, User Administrator, Helpdesk Administrator, Billing Administrator and Conditional Access Administrator (see Microsoft's documentation for all of them).
• Regular users are asked for MFA when necessary: Microsoft decides based on location, device, role and task, not on every sign-in.
• Legacy protocols are blocked, including Exchange ActiveSync with basic authentication.
• Device code flow is blocked — signing in by typing a code on a different device, a method often abused in phishing.
• Anyone using the Azure portal, Microsoft Entra admin center, Azure PowerShell or Azure CLI must complete MFA.
• The per-user MFA status page showing Disabled for everyone is normal under security defaults.

Separately from security defaults, Microsoft now requires MFA to sign in to its admin portals: the Azure portal, Microsoft Entra admin center, Microsoft Intune admin center and the Microsoft 365 admin center (rolled out gradually from February 2025). Security defaults extends that requirement to every employee.

Common problems

"Manage security defaults" can't be selected. Your organization has Conditional Access policies. Either use Conditional Access for MFA, or record their settings and delete all of them before you can turn on security defaults.

Printers and scanners can't send email. The device sends mail via SMTP AUTH with basic authentication (username and password), which isn't compatible with security defaults. Microsoft has also announced it will retire basic authentication for SMTP AUTH, so it has to change sooner or later. Microsoft's options: use OAuth if the device supports it; High Volume Email if it only sends internally; SMTP relay through a connector (needs a static IP or a certificate); or Direct Send (can only deliver to recipients inside your organization). Don't turn off security defaults for the whole company because of one printer.

An old mail app keeps asking for the password. The app uses legacy IMAP/POP3. Switch to Outlook or a mail app that supports modern sign-in. For a phone's built-in mail app, removing the account and adding it back is often enough.

An employee lost or replaced their phone. Someone with at least the Authentication Administrator role goes to Entra ID > Users, selects the person > Authentication methods > Require re-register MFA. Their old methods are removed and they register again at their next sign-in. Also choose Revoke sessions if you suspect the old phone ended up in someone else's hands.

Sign-in loops on an Exchange Online tenant created before 2017. Older tenants may have modern authentication turned off; turn it on following Microsoft's instructions.

When to move to Conditional Access

If your company already has Microsoft Entra ID P1 or P2 (through Business Premium, E3 or E5, for example), Microsoft says security defaults probably aren't the right fit — Conditional Access lets you set exceptions and apply policies by group, device and location. The main sequence:

1. Create two cloud-only emergency admin accounts that don't belong to any one person, for when every other admin is locked out. Because the admin portals require MFA even for these accounts, Microsoft recommends giving them a passkey (FIDO2) or certificate-based authentication.
2. Prepare the replacement policies. While security defaults are on you can still create Conditional Access policies, just not turn them on. Microsoft offers Microsoft-managed policies equivalent to security defaults, or you can use the Secure foundation templates: Require multifactor authentication for all users, MFA for admins, Block legacy authentication, and MFA for Azure management.
3. Exclude the two emergency accounts from the MFA policies (the templates exclude whoever created the policy by default — fix that).
4. Turn off security defaults, choose the reason My organization is planning to use Conditional Access, and immediately turn on the prepared policies to keep the window without MFA as short as possible.
5. Only then add your company's own policies. Don't turn off security defaults unless you are moving to Conditional Access.

Frequently asked questions

How should a small business turn on MFA for Microsoft 365?

Most should start with security defaults: available in every Microsoft 365 organization, simply on or off, nothing to tune. Conditional Access needs Microsoft Entra ID P1 or higher (included in Business Premium, E3, E5) and fits when you need exceptions or policies by group, device or location.

Printers can't send email after turning on security defaults — what now?

The printer sends mail via SMTP AUTH with a username and password, which isn't compatible with security defaults. Microsoft's options: OAuth if the device supports it, High Volume Email if it only sends internally, SMTP relay through a connector, or Direct Send. Don't turn off security defaults for the whole company because of one printer.

What if an employee loses or replaces their phone?

Someone with at least the Authentication Administrator role goes to Entra ID > Users, selects the person > Authentication methods > Require re-register MFA; they register again at their next sign-in. Also choose Revoke sessions if you suspect the old phone ended up in someone else's hands.