How to turn on multi-factor authentication in Microsoft 365
Security defaults switch on MFA for every user in a few clicks, at no extra cost. Here is how to do it and what your staff will see.
By Luis Freitas
Illustration: CybersecurityNews.ca
At a glance
Audience
Small business
IT & security teams
Difficulty
Beginner
Time needed (minutes)
30 min
Last reviewed
What you need
- A Global Administrator account
- A smartphone for each user (Microsoft Authenticator app)
Key takeaways
- Security defaults turn on MFA for every user at no extra cost
- Staff get 14 days to register the Authenticator app
- Use Conditional Access instead if you already have Business Premium
Multi-factor authentication (MFA) blocks most attacks that rely on stolen passwords. For small organizations on Microsoft 365, the quickest way to turn it on for everyone is security defaults, which is free and included with every tenant.
Steps
- Sign in to the Microsoft Entra admin center (entra.microsoft.com) with a Global Administrator account.
- Go to Identity > Overview > Properties and select Manage security defaults.
- Set security defaults to Enabled and save.
- Tell staff what to expect: at their next sign-in they will be asked to register the Microsoft Authenticator app, and they have 14 days to do it.
- Check that everyone registered, using the authentication methods report, and follow up with anyone missing.
Good to know
If you already use Conditional Access policies (included in Microsoft 365 Business Premium), manage MFA there instead: security defaults and Conditional Access cannot be used at the same time. Keep one emergency administrator account, stored securely, in case an authenticator phone is lost.
