TAZ IT SOLUTIONHow to turn on MFA in Microsoft 365
Multi-factor authentication (MFA) stops most account takeovers: even if someone steals a password, they cannot sign in without the code on your phone. Here is how to turn it on for your whole business in about 10 minutes.
Before you start
- You need a Global Administrator account for your Microsoft 365 tenant.
- Every user needs a smartphone with the free Microsoft Authenticator app (iPhone or Android).
- Tell your staff in advance: the next time they sign in, Microsoft will ask them to set up the app.
- This guide uses Security defaults, the free option that works for most small businesses on Microsoft 365 Business Basic or Standard. If you have Business Premium with Conditional Access policies, use those instead (we can help).
Step 1: Sign in to the Microsoft Entra admin center
Go to entra.microsoft.com and sign in with your administrator account.
Step 2: Open the tenant properties
In the menu, go to Entra ID > Overview > Properties.
Step 3: Turn on Security defaults
At the bottom of the page, click Manage security defaults. Set Security defaults to Enabled and click Save.
This turns on MFA registration for all users, always asks administrators for MFA, and blocks old sign-in methods that hackers like to abuse.
Step 4: Let each user set up Microsoft Authenticator
- Install Microsoft Authenticator on your phone.
- Sign in to Microsoft 365 on your computer. When you see "More information required", click Next.
- In the Authenticator app, tap + > Work or school account > Scan a QR code, and scan the code on your screen.
- Microsoft sends a test notification with a number. Type that number in the app to finish.
Users can also start this at any time from mysignins.microsoft.com/security-info.
Step 5: Check that everyone is set up
In the Entra admin center, go to Entra ID > Authentication methods > User registration details to see which users have registered for MFA.
Things to watch out for
- Old apps and devices: Security defaults block "legacy authentication". Very old Outlook versions, some phone mail apps and scan-to-email on older printers may stop sending or receiving mail. Update them, or contact us for a fix.
- Keep an emergency admin: Make sure at least two people can sign in as administrator, so you are never locked out.
- Lost phone? An administrator can reset a user's MFA methods so they can register again on a new phone.
Want us to do it for you?
Book the free 15-minute Microsoft 365 security check. We check MFA and five other common risks, and tell you what to fix.
Based on Microsoft's documentation for security defaults. Last updated October 2026.