How to Enable MFA in Microsoft 365

Why MFA matters

Multi-factor authentication means a stolen password alone is not enough to get into a mailbox. A Microsoft Research study of Entra ID accounts found MFA reduced the risk of compromise by 99.22%. Yet the UK Government's Cyber Security Breaches Survey 2025/26, published in April 2026, found only 47% of businesses had two-factor authentication in place, and that phishing was by far the most common attack, reported by 38% of businesses.

Microsoft has also made MFA compulsory for administrators: since February 2025, signing in to the Microsoft 365 admin center requires it. Extending it to every user is the logical next step.

Before you switch it on

• Create a break-glass account. An emergency global admin with a long, unique password stored safely, so one lost phone cannot lock you out of the whole tenant.
• Check licences. Business Basic and Standard use security defaults. Business Premium includes Entra ID P1 for Conditional Access.
• Find legacy sign-ins. Old Outlook versions, scanners sending email by SMTP, and apps using basic authentication will not cope with MFA. Plan replacements or app-specific workarounds.
• Tell staff. Explain what will happen, when, and that they need their phone. Unexpected prompts look like phishing.

Also decide who your administrators really are. Many small tenants have former staff or an old IT supplier still holding Global Administrator rights. Remove any you do not need, and give day-to-day admins lesser roles such as User Administrator or Exchange Administrator.

Option 1: security defaults (all plans)

1. Sign in to the Microsoft Entra admin center as a Global Administrator.
2. Open Overview under Entra ID (labelled Identity in some versions of the portal), then Properties, and choose Manage security defaults.
3. Set it to Enabled and save.

Users are asked to register the Microsoft Authenticator app at their next sign-in, with 14 days to complete it. Security defaults also block legacy authentication and require MFA for admin roles. It is all-or-nothing: you cannot exclude a user or skip MFA in the office. New tenants have security defaults on already, so check whether yours is enabled before assuming you have no MFA.

Option 2: Conditional Access (Business Premium)

Conditional Access gives finer control. You must turn security defaults off first, because the two cannot run together. In the Entra admin center, open Conditional Access and build policies, for example:

• Require MFA for all users on all cloud apps, excluding the break-glass account.
• Block legacy authentication.
• Require phishing-resistant MFA for admin roles.
• Require a compliant or Entra-joined device managed in Intune for access from PCs.

Start each policy in Report-only mode, check the sign-in logs for a week to see who would be affected, then switch it on. Microsoft also offers ready-made templates for these common policies.

Helping users register

Users install Microsoft Authenticator on their phone, then sign in at aka.ms/mysecurityinfo and add it. Number matching, where they type the number shown on screen into the app, defeats most 'MFA fatigue' attacks where criminals send prompt after prompt hoping someone taps Approve. Avoid SMS where you can. Make sure everyone adds a second method, so a new phone does not mean a lockout.

If Outlook starts prompting repeatedly afterwards, see Outlook keeps asking for password.

When to call dijitul

Call us if you have shared mailboxes or accounts used by several people, scanners or software that send email, a mix of licences, or no clear idea who your admins are. We plan the rollout, create a break-glass account, build and test policies in report-only mode, and help staff register, at £45 an hour + VAT. See password and MFA setup or contact us.

Our Complete plan, £99 a month + VAT, includes IT and Microsoft 365 helpdesk support, so lost phones and new starters are handled too.

Related