Multi-factor authentication (MFA) asks for something more than a password when someone signs in, usually a code or a tap in an app on their phone. It's one of the most effective things you can do to protect your business, because a stolen password on its own is no longer enough.
Here's how to switch it on across Microsoft 365 without locking anyone out.
Choose how you'll turn it on
Microsoft 365 gives you two main ways to require MFA.
Security defaults. A free set of baseline settings that requires every user to register for MFA and prompts them when it matters. It's on by default in many newer Microsoft 365 tenants. It's a good starting point for smaller businesses, but you can't make exceptions or fine-tune it.
Conditional Access. Policies that decide when MFA is needed, for example every sign-in from outside the office, or only from devices you don't manage. It needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. It's the better option for most growing businesses.
You use one or the other, not both. Older guides also mention "per-user MFA". Microsoft now steers businesses towards the two options above instead.
Prepare before you switch it on
- Tell your team. Explain what's changing, when and why. People cooperate when they're not surprised.
- Pick the method. The Microsoft Authenticator app is the most practical choice for most staff. Text messages work as a fallback but are less secure.
- Sort out shared accounts. Shared mailboxes should be accessed through delegation, not by sharing a login. If an account truly has to be shared, store its MFA in a shared password manager.
- Keep an emergency admin account. Have one administrator account excluded from your Conditional Access policies, with a long password kept somewhere safe, so a misconfigured policy can't lock everyone out.
Roll it out
Start with yourself and a small group. Check that sign-in works on phones, laptops and anything else people use. Then ask everyone to register before the date MFA is enforced.
Check who has registered before you enforce it. Registered and enforced aren't the same thing. Anyone who hasn't registered will be stopped at their next sign-in.
After it's on
Expect a few questions in the first week, mostly from people with new phones. Have a simple process for resetting someone's MFA when they change devices.
We set this up as part of our Microsoft 365 work and every managed IT client gets it as standard. If you'd like a hand, talk to us.