Module 1 of StartCloud's Microsoft 365 Security Essentials learning pathway, in six short units with a knowledge check: what MFA is, the three ways to run it in Microsoft 365, how to choose, and the exact steps to switch it on.
How to Turn On Multi-Factor Authentication in Microsoft 365
Why passwords alone stopped being enough
Here is the uncomfortable truth about passwords: yours has probably already leaked somewhere. Breaches happen constantly, and people reuse the same password across a dozen sites. If a scammer gets one, they will happily try it on your Microsoft 365 login too.
Multi-factor authentication (also called MFA, two-factor, or 2FA) closes that door. It asks for a second proof of identity at sign-in, usually a quick tap on your phone. Microsoft rates it as the number one way a business can protect its data, and after years of cleaning up accounts that did not have it, we wholeheartedly agree.
Think of MFA like the second latch on a hotel room door. It will not stop a determined ram-raid, but it absolutely stops the person who found your key card in the lift. For the overwhelming majority of real-world attacks, that second latch is the whole game.
MFA is not the hassle people expect. Most of the time it is a single tap, and the whole thing takes about three seconds. Here is what actually happens when you sign in.
Your username and password, same as always. On its own, this is the bit a scammer can phish, guess, or buy off a leaked list.
A prompt on your phone, usually a tap in the Microsoft Authenticator app (or better still, a hardware security key, which even a convincing fake login page cannot trick). Either way, the attacker in another country does not have it in their pocket.
Both checks pass, so you sign in without a fuss. The stolen password on its own gets a scammer precisely nowhere.
Microsoft gives you three routes to the same destination. Most businesses only ever need one of the first two.
The one-switch option
A single on/off toggle that turns on MFA for everyone in your tenant. Free with every Microsoft 365 plan through Microsoft Entra ID Free, and already switched on for any tenant created after October 2019.
- Free with every Microsoft 365 plan
- Covers all users, including admins
- No rules to configure, nothing to babysit
- Best for small teams that want solid cover, fast
The rules-based option
Fine-grained MFA driven by policies, for example require MFA for everyone and block legacy sign-in methods entirely. Needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and E3.
- Requires Entra ID P1 (Business Premium, E3)
- Vary rules by user, group, location, or app
- Block legacy authentication cleanly
- Test safely in Report-only mode first
The one to avoid
The old approach, switched on account by account. Microsoft no longer recommends it, and neither do we. If your tenant started after 2019 it is almost certainly off already, and it should stay that way.
- Managed one user at a time
- No central rules or reporting
- Superseded by the two options above
- Only a fallback on very old setups
You do not need to overthink this. Two questions land you in the right place.
Do you have Business Premium, E3, or E5?
These include Microsoft Entra ID P1 or P2.
Use Security defaults
Free, on by default, and plenty for most small teams. You are done.
Need to vary rules by user, location, or app?
No
Defaults are fine to start
Use Conditional Access
Golden rule: doing something beats doing nothing. Security defaults today is far better than a perfect Conditional Access policy you never get around to.
Two things to sort out first
Permissions. You will need to be a Global Administrator or Security Administrator to change these settings. Microsoft recommends keeping the powerful Global Administrator role for emergencies only, and doing day-to-day work from a lower-privilege account.
Break-glass accounts. Set up at least two emergency access accounts that are excluded from MFA. These are not tied to any one person and are only ever used if you get locked out of everything else.
Locking yourself out of your own tenant is a genuinely awful afternoon, and we would rather you never have one. Two emergency accounts, strong unique passwords, stored somewhere safe and offline. Set them up before you tighten anything.
Pick the route that matched your answer in the previous unit. Both start in the Microsoft Entra admin center at entra.microsoft.com.
- 1Sign in to the Microsoft Entra admin center at entra.microsoft.com.
- 2Go to Identity, then Overview, and open the Properties tab.
- 3Scroll to the Security defaults section at the bottom.
- 4Select Manage security defaults, set it to Enabled, and Save.
Once it is on, everyone gets 14 days to register the Microsoft Authenticator app. After that, no registration means no sign-in, so give your team a heads-up before you flip the switch.
- 1Turn off security defaults first. You cannot run both at once.
- 2Recreate the baseline with Microsoft's templates: Require MFA for all users, and Block legacy authentication.
- 3Exclude only your two break-glass accounts from the MFA requirement.
- 4Add any further policies your business needs from there.
A tip worth its weight in gold: create each new policy in Report-only mode first. It shows you exactly who would be affected, using your real sign-in logs, without locking a soul out. Happy with it? Switch it to On.
- Microsoft Learn: Set up multifactor authentication for Microsoft 365
- Microsoft Learn: Security defaults in Microsoft Entra ID
- Microsoft Learn: Plan a Conditional Access deployment
- Microsoft Learn: Manage emergency access accounts in Microsoft Entra ID
Steps were current at the time of writing (July 2026). Microsoft occasionally moves things around the admin centre, so screens may vary slightly.
Knowledge check
5 quick questions. Get 4 right and the module is yours.
1. What does MFA actually add to your sign-in?
2. Which MFA option is free with every Microsoft 365 plan?
3. What do you need before you can use Conditional Access?
4. Break-glass accounts are...
5. You have just built a new Conditional Access policy. What is the smart first move?