Security guide
Rolling Out Multi-Factor Authentication in Microsoft 365: A Practical Plan
Multi-factor authentication is the single most effective control against account takeover, and Microsoft 365 includes everything needed to enforce it. Most rollouts that cause disruption fail on planning rather than technology: users not registered in time, shared accounts no one accounted for, or old devices relying on legacy sign-in.
Choose the enforcement method
| Security defaults | Conditional Access | |
|---|---|---|
| Licensing | Included in all tenants | Entra ID P1 or higher |
| Flexibility | On or off only | Policies by user, app, location and device |
| Legacy authentication | Blocked | Blocked by policy |
| Best suited to | Small organizations with simple needs | Organizations that need exceptions or device-based rules |
The two can't be used together. If you create Conditional Access policies, security defaults must be turned off first.
Step-by-step
Inventory accounts and dependencies
List every account, including shared logins, service accounts used by scanners and applications, and accounts used by external contractors. Identify anything that signs in with legacy protocols, such as older mail clients or devices using Basic authentication, because those will stop working when legacy authentication is blocked.
Create emergency access accounts
Create two cloud-only administrator accounts with long, randomly generated passwords stored securely offline, and exclude them from Conditional Access policies. They exist so that a misconfigured policy or MFA service outage can't lock every administrator out of the tenant.
Communicate and register users
Tell staff what will change, when, and why. Ask them to register the Microsoft Authenticator app in advance at
aka.ms/mysecurityinfo, and track registration in the Entra admin center. Under security defaults there is no longer a grace period for registration, so registration should be complete before enforcement.Pilot with a small group
Enable enforcement for IT and a few willing users first. Use the pilot to confirm that mobile email, Teams, line-of-business applications and remote access all work as expected.
Enforce for everyone and block legacy authentication
Turn on security defaults, or extend your Conditional Access policies to all users with the emergency accounts excluded. Revoke existing sessions so everyone signs in again under the new rules. Monitor sign-in logs closely for the first week.
Strengthen over time
Prefer the Authenticator app or phishing-resistant methods such as FIDO2 security keys over text messages. With Conditional Access, consider requiring compliant devices for access to sensitive data.