Enable tenant MFA for Microsoft 365 now, either through security defaults or a Conditional Access baseline, and register phishing-resistant methods such as FIDO2 security keys or Windows Hello for Business for every admin and sensitive role. Manage this from the Microsoft Entra admin centre, and set up at least two emergency access accounts before you enforce anything. This single step blocks the overwhelming majority of unauthorised sign-in attempts.
Setting up MFA for Microsoft 365: the Entra admin centre quickstart
Before you touch a single policy, decide whether security defaults or a full Conditional Access baseline suits your tenant. Security defaults give every user a basic MFA requirement with no licence cost, which works well for smaller tenants with no complex access rules. Conditional Access, by contrast, lets us target policies by role, application, location or device, and it needs Microsoft Entra ID P1 or the licence bundled into Microsoft 365 Business Premium.
Once you have chosen a route, the work happens in the Microsoft Entra admin centre:
- Go to Protection > Authentication methods to see which methods are enabled tenant-wide.
- Add or enable Microsoft Authenticator, FIDO2 security keys and Windows Hello for Business under the relevant method policies.
- Build or confirm your Conditional Access policy under Protection > Conditional Access, scoping it to the correct users and apps.
- Register at least two emergency access accounts and exclude them explicitly from any blocking policy, as Microsoft’s emergency access guidance recommends.
To confirm the rollout worked, check each user’s authentication method status from the Authentication methods blade, and run a test sign-in from a new device to confirm the MFA prompt appears correctly. A quick way to spot gaps is a short checklist:
- Confirm the correct licence tier (Entra ID P1, P2 or Business Premium) covers every Conditional Access feature you plan to use.
- Verify that emergency accounts are excluded and tested, not just created.
- Check that at least two people hold active global admin rights with MFA registered.
Choosing authentication methods: what NCSC guidance recommends
Not every MFA method offers the same protection, and the order matters. The NCSC’s guidance on MFA for corporate online services sets out a clear ranking: FIDO2 security keys and platform credentials first, then challenge-based authenticator apps, then app code generators, then hardware OATH tokens, with SMS and email-based codes recommended only as a last resort.
The reasoning is straightforward. FIDO2 keys and Windows Hello for Business bind the credential to the device and the specific website, which makes them resistant to phishing and man-in-the-middle attacks in a way that a text message code never can be. Microsoft Authenticator, used in its number-matching mode, sits a tier below but still beats anything delivered over SMS.
- FIDO2 security keys and Windows Hello for Business: phishing-resistant, best for admins and sensitive roles.
- Microsoft Authenticator (app-based, number matching): strong, practical for most staff.
- Hardware OATH tokens: useful where phones aren’t permitted or practical.
- SMS and email codes: weakest option, acceptable only as a fallback.
Implementing MFA blocks over 99% of unauthorised access attempts, according to Microsoft’s Digital Defense Report 2025, which underlines why the method you choose matters less than making sure every account has one switched on. As a practical rule, require phishing-resistant methods for any account with administrative rights or access to sensitive applications, and let standard staff use Authenticator as the everyday default.
Enforcing MFA with Conditional Access and authentication strengths
Conditional Access becomes far more useful once you combine it with authentication strengths, a Microsoft Entra feature that groups methods by how robust they are. Microsoft’s documentation defines three built-in strengths: Multifactor authentication strength (any approved MFA method), Passwordless MFA strength, and Phishing-resistant MFA strength (FIDO2 and certificate-based methods only).
In practice, this lets us tier protection by risk rather than applying one blunt rule to everyone:
- A baseline policy requiring Multifactor authentication strength for all users across Microsoft 365 apps.
- A tighter policy requiring Phishing-resistant MFA strength for global admins, finance systems and any app handling sensitive data.
- An explicit exclusion for emergency access accounts, so a policy misconfiguration can never lock every administrator out at once.
Scoping matters as much as the policy content. Conditional Access and authentication strengths both need Microsoft Entra ID P1 as a minimum, with some advanced risk-based conditions reserved for P2. Before enforcing a policy tenant-wide, run it in report-only mode first, and check the sign-in logs to confirm it affects the users you intended and no one else.
Fixing common MFA sign-in problems
Most MFA failures trace back to a handful of causes, and a short diagnostic routine usually finds the culprit faster than raising a support ticket.
- Check device time synchronisation first: a clock more than a few minutes out can invalidate authenticator codes.
- Confirm which methods are actually registered for the affected user in the Entra admin centre, since a removed phone or reset authenticator app is a frequent cause of lockouts.
- Review recent sign-in logs for revoked sessions or conditional access denials that might explain the block.
- Check device compliance status if a Conditional Access policy requires a managed or compliant device.
Specific error codes point to specific fixes: AADSTS50074 means MFA is required but wasn’t completed, AADSTS50079 means the user must register for MFA before signing in, and AADSTS90072 usually points to a cross-tenant or guest access restriction. Matching the code to its cause saves time that would otherwise go into guesswork.
Pro Tip: Keep a documented, tested recovery playbook for emergency access accounts rather than relying on memory during an actual lockout.
For the hardest cases, particularly where a sole global admin has lost MFA access, Microsoft’s own support threads confirm that self-service recovery often isn’t possible, which is exactly why multiple active administrators matter.
Rolling out MFA without burning out your users
A phased rollout avoids the support desk pile-up that comes from forcing every user through MFA registration on the same Monday morning. Start with a pilot group, typically IT and a handful of willing early adopters, then expand department by department with clear instructions on registering Microsoft Authenticator or a security key.
- Send a short communication in advance explaining why MFA is changing and what each user needs to do.
- Offer a simple walkthrough or short training session rather than relying on a help article alone.
- Monitor sign-in logs weekly during rollout to catch recurring failures early.
One anti-pattern worth avoiding deliberately: prompting users to reauthenticate too frequently. The NCSC has warned that excessive re-authentication breeds security fatigue and, counter-intuitively, increases the risk that someone approves a fraudulent prompt out of habit. Risk-based Conditional Access prompts, which only challenge a user when something looks unusual, strike a better balance.
Pro Tip: Test your emergency access accounts on a quarterly schedule, not just when you set them up, so a credential change elsewhere in the tenant never leaves you locked out.
How we approach Microsoft 365 MFA for the businesses we support
Security by Default sits at the centre of how we work with clients, which means MFA, Conditional Access and emergency access planning are built into every Microsoft 365 engagement from the outset rather than treated as an afterthought. Our work typically covers policy design, Conditional Access configuration, phishing-resistant method rollout for privileged accounts, and ongoing monitoring once the policies are live.
For teams without the in-house capacity to manage this continuously, that oversight extends to proactive checks on emergency account status and sign-in anomalies, so MFA remains a live control rather than a one-off project.
Get MFA set up properly across your Microsoft 365 tenant
Configuring Conditional Access, authentication strengths and emergency access correctly takes time most internal IT teams don’t have spare, and getting it wrong can lock out the very administrators meant to fix it. Our Microsoft 365 management service handles this configuration as part of ongoing support, backed by managed cyber security for monitoring and incident response once policies are live.
- Managed IT Support: ongoing management of your Microsoft 365 tenant and wider IT estate.
- Microsoft 365 Management: Conditional Access, authentication methods and tenant configuration.
- Outsourced IT Manager: strategic oversight for teams without a dedicated IT lead.
FAQ
Is MFA required for Microsoft 365?
Microsoft has been rolling out mandatory MFA enforcement for admin portals, with Microsoft 365 admin centre enforcement starting from February 2025. Outside of these enforced scenarios, MFA for standard users still depends on your tenant’s security defaults or Conditional Access configuration, so it is strongly recommended rather than universally forced for every account type.
How do I set up MFA in Office 365?
Enable MFA either through security defaults for a simple tenant-wide requirement, or through Conditional Access for role-based control, both configured in the Microsoft Entra admin centre under Protection. From there, add methods such as Microsoft Authenticator or FIDO2 security keys under Authentication methods, then build and test your Conditional Access policy before enforcing it for everyone.
How do I know if MFA is enabled in Office 365?
Check the Authentication methods blade in the Microsoft Entra admin centre for each user, which shows which methods are registered and active. You can also review Conditional Access policy reports or sign-in logs to confirm whether MFA challenges are actually being enforced during sign-in.
How do I enable multi-factor authentication per user in Office 365?
Per-user MFA can be managed from the legacy per-user MFA page in the Microsoft 365 admin centre, though Conditional Access is now the recommended approach for most tenants. Conditional Access lets administrators apply MFA requirements selectively by user, group, application or risk level, rather than toggling a single setting for each individual account.
