How to set up MFA in Microsoft 365

What MFA actually stops

A password is a single key that can be copied without you knowing, usually by a fake Microsoft sign-in page: an email says a document is waiting, the page looks right, the password goes in, and someone on the other side of the world has it. With MFA on, that password is useless without your phone as well.

The scam that follows is the one that costs small businesses real money. The attacker sits quietly in the mailbox for a few weeks, reads how you send invoices, then sends a customer "our updated bank details" from your address. You find out when the customer says they've already paid. Microsoft's own position is that MFA plus blocking old sign-in methods stops the overwhelming majority of these attacks, and it's the one item on the Australian Cyber Security Centre's Essential Eight a small business can do in an afternoon.

It isn't magic: someone can still be talked into reading a code out over the phone. The settings below close most of the other gaps.

Security defaults or Conditional Access?

Microsoft gives you two ways to require MFA. You can't run both at once, and the right one depends mostly on which plan you're paying for.

Microsoft also still offers "per-user MFA", the old way. Don't use it for a new set-up; Microsoft itself says so.

Turning on security defaults

Tenants created after late 2019 may already have this on. Check before you assume.

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) with a Global Administrator account.
2. Go to Entra ID → Overview → Properties (some tenants show Identity → Overview). At the bottom of that tab choose Manage security defaults, set it to Enabled, and save. Menus move; if it's not there, search the admin centre for "security defaults".
3. Register your own account first. Sign out and back in, install Authenticator when prompted, and make sure you can get in before anyone else has to.
4. Tell staff it's happening. Don't count on a grace period: the next time each person signs in, expect them to be walked through setting up Authenticator before they can continue.

That's it; there's nothing else to maintain.

Setting up Conditional Access (Business Premium)

Before you touch a policy, create a break-glass account: a cloud-only account (something like emergency@yourbusiness.onmicrosoft.com) with the Global Administrator role that nobody uses day to day. Microsoft recommends two, secured with a hardware security key rather than an app on someone's phone, with the details kept somewhere physical and safe. It exists so a policy mistake or a lost phone can't lock the whole business out. Test it every few months.

1. Turn off security defaults in the same place you'd turn them on. The dropdown asks why; choose the option that says you're moving to Conditional Access. Do the next steps straight away so there's no gap.
2. Go to Microsoft Entra admin center → Protection → Conditional Access → Policies and choose New policy from template. Microsoft's "Secure foundation" templates recreate what security defaults did, which is the right starting point.
3. Create Require multifactor authentication for all users. The template excludes the account you're signed in as; swap that exclusion for your break-glass account before saving. If you're nervous, run it as Report-only for a week, read the sign-in logs, then switch it On.
4. Create Block legacy authentication. Old mail apps and basic SMTP can't do MFA, so a stolen password works there even when MFA is on everywhere else; attackers try them first. It usually needs no exclusions.
5. Create Require multifactor authentication for admins (there's also a phishing-resistant version that insists on a security key). Admins get prompted every time, no exceptions.
6. Later, optionally: require a company-managed laptop for email and files, or block sign-ins from countries you don't work in. Get the first three live before adding more.

Rolling it out without a revolt

The technical part takes an hour. The part that goes wrong is people. What works:

• Announce it a week ahead, in one plain email or a toolbox talk: what's changing, when, why (tell the fake-invoice story), and that it takes five minutes with a phone in hand.
• Get Authenticator installed before the day. It's free on the App Store and Google Play, publisher Microsoft Corporation. Look-alike apps charge a subscription, so send people the official download page.
• Use Microsoft's registration campaign if you're on Premium: Entra admin center → Protection → Authentication methods → Registration campaign. It nudges people to set up Authenticator at sign-in and lets them snooze for a few days, kinder than a hard stop on someone standing on a client's site.
• Do the first sign-in with them. Ten minutes per person on a call, screen shared. Have them add a second method (a phone number, or a second device) while you're there, so a dropped phone isn't a lockout.
• Shared mailboxes don't sign in. Your info@ or accounts@ mailbox is opened by people with their own accounts, so it needs no MFA of its own; block sign-in on its account entirely. If someone has been signing in to it with its own password, that's the habit to break.
• App passwords are gone. They let old programs skip MFA. Security defaults and the block-legacy policy both stop them working, which is the point; anything that needs one needs a different way to send mail (see the scanner note below).
• "I'm not putting work stuff on my phone." Authenticator can't see anything on the phone; it only receives prompts. If someone still refuses, a hardware security key costs less than an hour of your time.

The gotchas

Lost, broken or new phones

An admin fixes this in Entra admin center → Users → the person → Authentication methods by deleting the old method; the person sets Authenticator up again at their next sign-in. With a second method registered they can do it themselves. Before a planned phone swap, have them add the new phone at mysignins.microsoft.com/security-info while the old one still works.

Number matching

The sign-in screen shows a two-digit number and the person types it into Authenticator, so nobody can approve a prompt they didn't start. That closes the old trick of sending prompts until someone tapped yes to make them stop. If a prompt arrives when you're not signing in, deny it and change your password.

Printers, scanners and software that email as you

Scan-to-email on the office printer, and some job and practice software, send mail through Microsoft 365 with a username and password over SMTP. Blocking legacy authentication blocks that. Microsoft's guide to the options is the one to hand your IT person: a relay connector tied to your office's internet connection, "direct send" if scans only go to people in the business, or a separate sending service. Under Conditional Access you can also give the scanner its own single-purpose mailbox and exclude just that one from the legacy block. Whatever sends, your SPF record must cover it; our junk-folder guide explains why.

The owner's account

In most small businesses the owner's everyday email account is also the Global Administrator. Microsoft recommends a separate admin account used only for admin work, so the account that opens every attachment isn't the one that can delete the company. Admins are prompted every sign-in, which is fine for an account you use once a month.

Checking it's actually working

• Who has registered: Entra admin center → Protection → Authentication methods → User registration details lists every person and the methods they've set up. Chase the blanks.
• The per-user MFA page shows "Disabled" for everyone. That's normal: security defaults and Conditional Access don't use that old switch. Don't "fix" it by enabling per-user MFA on top; you'll get double prompts and odd lockouts.
• Sign-in logs: Entra admin center → Monitoring & health → Sign-in logs. The "Authentication requirement" column says whether each sign-in was single-factor or multifactor. Filter for single-factor and legacy-authentication sign-ins; what's left is usually a scanner, Office 2013 or an old mail app that can't do modern sign-in, or a service account someone forgot. Find those before you block legacy authentication, not after.
• Try to break it. From a browser you've never used, sign in as yourself. If you get to the inbox with just a password, something's wrong.

Check both again a week later, then monthly. New starters and new phones are where it quietly drifts.

Where we fit

Turning on MFA, moving Premium tenants to Conditional Access and tidying up the scanners and old apps around it is part of how we run every Microsoft 365 tenant we look after, and it's the first line of our security checklist for small business. We do the registration calls with your staff, and the weekly sign-in report tells you it's still holding.