Microsoft documents three ways to require multifactor authentication in Microsoft 365. Security defaults suit every organization and Microsoft recommends them as the baseline. Conditional Access policies give finer control and need a paid Entra plan. Legacy per user MFA is a last resort that Microsoft does not recommend.
Passwords alone no longer protect a Microsoft 365 account. Multifactor authentication adds a second verification step at sign in.
Steps follow the Microsoft Learn article on setting up multifactor authentication. Admin roles are needed for every method.
Which MFA Option Fits Your Organization?
| Option | Availability | Microsoft notes |
|---|---|---|
| Security defaults | All organizations on Microsoft Entra ID Free | Recommended baseline and on by default for tenants created after October 2019 |
| Conditional Access | Microsoft Entra ID P1 or P2 | Higher security and finer control |
| Legacy per user MFA | All organizations on Entra ID Free | Not recommended and a last resort |
Which Admin Role is Needed?
Security defaults need a Global Administrator or Security Administrator. Conditional Access needs a Global Administrator or Conditional Access Administrator. Microsoft recommends the role with the fewest permissions and limits Global Administrator to emergencies.
How to Enable Security Defaults?
- Open the Microsoft Entra admin center and go to Identity then Overview.
- Select the Properties tab.
- Scroll to Security defaults and select Manage security defaults.
- Set the dropdown to Enabled and select Save.
Manage security defaults is not available when Conditional Access policies exist. Disable legacy per user MFA first.
How to Move to Conditional Access?
- Disable security defaults. Both cannot be enabled together.
- Create baseline policies. Go to Conditional Access and Policies, select New policy from template and choose the Secure foundation templates for MFA for all users and MFA for administrators.
- Adjust exclusions. Templates exclude your current account. Replace it with at least two emergency access accounts.
Record every policy setting before you delete one because deletion is permanent. Related reading: how to encrypt Outlook emails and how to fix Outlook 2019 not opening.
Frequently Asked Questions
How do I Enable MFA in Microsoft 365?
Enable security defaults in the Microsoft Entra admin center or create Conditional Access policies.
Are Security Defaults Enough?
Microsoft recommends them as the baseline for all organizations.
What do Conditional Access Policies Need?
They need Microsoft Entra ID P1 or P2, available in Business Premium, E3 or E5.
Is Legacy MFA Recommended?
Microsoft calls it a last resort and recommends security defaults or Conditional Access.
Key Takeaways
- Microsoft names three MFA options.
- Security defaults are the recommended baseline.
- Conditional Access needs a paid Entra plan.
- Security defaults and Conditional Access cannot be enabled together.
- Emergency access accounts need exclusion from MFA policies.
Sources and References
Facts follow Microsoft Learn.
- Set up multifactor authentication for Microsoft 365 (Microsoft Learn) learn.microsoft.com