How to Turn On Multi-Factor Authentication in Microsoft 365 for a Small Business

A stolen password is still the most common way into a small business's email. Multi-factor authentication (MFA) fixes most of that problem: even if someone has the password, they also need something only the real user has, usually their phone. Microsoft states that MFA and blocking legacy sign-ins stop more than 99.9% of common identity attacks.

This guide explains the two main ways to turn on MFA in Microsoft 365, which sign-in methods to use, and how to roll it out without locking anyone out.

Before you start

• Create two emergency access ("break glass") admin accounts. Microsoft recommends two cloud-only accounts with the Global Administrator role, used only if normal admin access fails. Protect them with a passkey or security key and store the details somewhere safe.
• List devices and apps that sign in with just a password. Old copiers and scanners that send email, accounting software that reads a mailbox, and older Outlook versions may use legacy sign-ins that MFA blocks.
• Check who has admin roles. Remove admin rights from anyone who does not need them.
• Tell your staff what is coming. A short email with the date, what they will see, and who to call goes a long way.

Option 1: Security defaults (simple, free)

Security defaults are a single on/off switch that applies Microsoft's baseline protections to the whole tenant. According to Microsoft's security defaults documentation, they:

• Require every user to register for MFA
• Require MFA for administrators every time they sign in
• Prompt users for MFA when Microsoft judges it necessary, based on factors such as location, device and role
• Block legacy authentication protocols that cannot do MFA
• Block device code sign-in flow, which attackers abuse in phishing

Users register the Microsoft Authenticator app with push notifications. Since July 2024 there is no grace period: users must set up MFA at their next sign-in.

How to turn on security defaults

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Go to Entra ID > Overview > Properties.
3. Select Manage security defaults.
4. Set Security defaults to Enabled and select Save.

Many tenants created since October 2019 already have security defaults on. It is worth checking, because someone may have switched them off years ago.

The catch: security defaults are all or nothing. You cannot exclude a scanner account, require a specific method, or treat the office network differently.

Option 2: Conditional Access (flexible, needs a license)

Conditional Access lets you write your own rules, such as "require MFA for everyone, but require a phishing-resistant method for admins" or "block sign-ins from outside the countries we work in". It requires Microsoft Entra ID P1 or higher, which is included in Microsoft 365 Business Premium. Security defaults must be turned off before Conditional Access policies take over, so build your policies first.

A sensible starting set for a small business:

• Require MFA for all users
• Require MFA (ideally phishing-resistant) for all admin roles
• Block legacy authentication
• Require MFA to register or change security info

Microsoft provides Microsoft-managed Conditional Access policies and templates that cover these basics. Always exclude your emergency access accounts, and run new policies in Report-only mode for a few days to see who would be affected before switching them on.

	Security defaults	Conditional Access
License needed	None	Entra ID P1 or higher (e.g. Business Premium)
Setup effort	One switch	Several policies to design and test
Exceptions	None	Per user, group, app, location or device
Best for	Very small offices, basic licenses	Offices that need flexibility or stronger admin rules

Which sign-in methods to use

Microsoft Authenticator with number matching

This is the everyday choice for most staff. When someone signs in, the screen shows a number and they type that number into the Authenticator notification on their phone. Microsoft has made number matching standard for all Authenticator push notifications, and users cannot opt out. It defeats "MFA fatigue" attacks, where a criminal sends prompt after prompt hoping someone taps Approve.

Teach staff one rule: if you get a prompt you did not start, deny it and tell IT. It means someone has your password.

Passkeys: the strongest option

Passkeys replace the password and the code with a cryptographic key tied to the user's device. A fake login page cannot capture or reuse them, which is why they are called phishing-resistant. In Microsoft 365 you can use:

• Passkeys stored in Microsoft Authenticator (iOS 17 or later, Android 14 or later)
• Hardware security keys (FIDO2) that plug into USB or tap via NFC
• Windows Hello for Business on company PCs

Admins enable them under Entra ID > Authentication methods > Passkey (FIDO2). Start with administrators and anyone who handles payments, then expand.

Text messages and phone calls

SMS codes and voice calls are better than nothing, but they are the weakest methods and can be intercepted or redirected. Keep them as a backup only, or turn them off once everyone has Authenticator or a passkey.

Admin portals already require MFA

Microsoft now enforces MFA for its admin portals, including the Microsoft 365 admin center (rolled out from February 2025), the Azure portal, the Entra admin center and the Intune admin center. There is no opt-out. If your admins can sign in to those portals today, they already have a method registered. Make sure everyone else does too.

A rollout plan that avoids lockouts

1. Create and test your two emergency access accounts.
2. Fix or replace anything that still uses legacy sign-ins (scanners, old apps, old Outlook).
3. Send staff instructions and a date. Point them to mysignins.microsoft.com/security-info to register early.
4. Turn on MFA for admins first, then a small pilot group.
5. Turn on security defaults or your Conditional Access policies for everyone.
6. Check sign-in logs during the first week for failures and help people who are stuck.
7. Add passkeys for admins and finance staff.

Common snags

• Lost or replaced phone: an admin can issue a Temporary Access Pass so the user can sign in once and register the new device.
• Staff without a work phone: use a hardware security key instead of asking them to install apps on a personal phone.
• Shared mailboxes: give people access through their own accounts rather than sharing one password.
• Scanner-to-email stops working: switch it to an SMTP relay or a supported connector rather than turning MFA off.

Want it done for you?

Turning on MFA takes minutes. Doing it without breaking the copier or locking out the owner on a Friday afternoon takes planning. Right On Tech sets up Microsoft 365 security for small businesses as part of our managed IT service, including Conditional Access, passkeys and staff onboarding.