Enforce MFA for Microsoft 365: An SMB Admin's Setup Guide

For most small and midsize businesses, the fastest safe path is enabling Security Defaults today, then graduating to Conditional Access once you have Entra ID P1 or Business Premium and time to test properly. Before you touch either setting, confirm your licensing and create two emergency access accounts excluded from any MFA policy.

• Right now: enable Security Defaults if you have no Conditional Access policies yet.
• Before enforcement: run Conditional Access in report-only mode and check the What If tool.
• Always: keep at least two break-glass accounts outside every policy.

Key Takeaways

Successful MFA enforcement for Microsoft 365 depends on emergency access accounts, a legacy-authentication inventory, and report-only testing completed before any policy goes live.

Point	Details
Start with Security Defaults or Conditional Access	Use Security Defaults for a fast, free baseline; move to Conditional Access once you need per-group or per-app control.
Build emergency accounts first	Create at least two break-glass accounts excluded from every MFA policy before making changes.
Test before you enforce	Run new Conditional Access policies in report-only mode and check the What If tool for 48 to 72 hours.
Prioritize phishing-resistant methods	Use Microsoft Authenticator for most users and FIDO2 or passkeys for every admin account.
Roll out in waves	Pilot with IT, then critical users, then department waves, to keep help desk volume manageable.
Get expert help if needed	Collett Systems LLC runs Microsoft 365 assessments and manages phased MFA rollouts with 24/7 monitoring for Wisconsin businesses.

Table of Contents

• What You Need Before You Enable MFA for Microsoft 365
• Security Defaults or Conditional Access: Which Fits Your Business?
• How Do I Configure MFA for Microsoft 365 Step by Step?
• Which MFA Methods Should Microsoft 365 Users Use?
• How Should You Roll Out MFA Across the Organization?
• How Do You Verify MFA Is Working and Fix Problems Fast?
• What Collett Systems Sees Managing MFA for Real Businesses
• Why Most MFA Advice Skips the Part That Actually Causes Outages
• Get a Microsoft 365 Assessment Before You Flip Any Switch
• Sources
• FAQ

What You Need Before You Enable MFA for Microsoft 365

Two failure modes wreck an MFA rollout: locking out the whole company, or discovering halfway through that half your users can't register. Both come from skipping prep.

• Check your license tier in the Microsoft 365 admin center. Conditional Access requires Entra ID P1 or P2, which comes bundled in Business Premium; Security Defaults needs nothing extra.
• Pull your sign-in logs and filter for legacy authentication (POP, IMAP, older Office clients) since those protocols can't prompt for MFA at all and often need to be retired first.
• Create at least two emergency accounts with strong, unique passwords, exclude them from every policy, and store credentials somewhere outside Microsoft 365 entirely.
• Decide upfront which authentication methods you'll allow and what backup option each user needs if they lose a phone.

Pro Tip: Store your break-glass account credentials in a physical safe or a separate password vault, not in a document inside the same tenant you might get locked out of.

Security Defaults or Conditional Access: Which Fits Your Business?

Security Defaults is Microsoft's free, tenant-wide switch. It requires MFA registration for every user and admin and blocks legacy authentication automatically, with zero configuration. That makes it a strong fit for a 10-person shop with no compliance mandate and no appetite for policy management.

The tradeoff is rigidity. Security Defaults applies the same rule to everyone, with no exceptions for trusted networks, specific apps, or device compliance. Conditional Access solves that but costs more in setup time and licensing:

• Scope policies by user group, application, sign-in risk, device, or location.
• Exempt service accounts and legacy line-of-business tools with documented, logged justification instead of blanket exclusions.
• Layer multiple policies (admin protection, legacy auth blocking, session controls) instead of one flat rule.

If you outgrow Security Defaults, Microsoft's setup guidance walks through recreating the same baseline protections as Conditional Access policies before you turn Security Defaults off, so you're never unprotected mid-transition.

How Do I Configure MFA for Microsoft 365 Step by Step?

The sequence matters more than any single setting. Here's the order that keeps you from getting locked out.

1. Enable Security Defaults first if you have nothing in place. In the Microsoft 365 admin center, go to Entra ID properties and toggle Security Defaults on. Every user gets prompted to register MFA on their next sign-in.
2. If you're licensed for Conditional Access, turn off Security Defaults only after building replacement policies, using Microsoft's Conditional Access templates: require MFA for admins, require MFA for all users, block legacy authentication, and require MFA for Azure management.
3. Set every new policy to report-only mode first. Nothing gets blocked yet, but Entra ID logs exactly who would have been affected.
4. Run the What If simulator against a handful of real users and apps to confirm the policy behaves the way you expect before anyone sees a prompt.
5. Review report-only results for 48 to 72 hours, checking for unexpected blocks tied to service accounts, third-party integrations, or legacy clients you missed in your inventory.
6. Flip qualifying policies to On, starting with admin accounts, then expanding once the data looks clean.
7. Revisit exclusions. Emergency accounts stay excluded permanently; service principals get their own scoped policy instead of a blanket pass; any other exception needs a written reason and an expiration date.

Pro Tip: Never enable a brand-new Conditional Access policy directly to "On" for your whole tenant. Report-only mode costs you a couple of days and saves you a Monday morning of help desk calls.

Which MFA Methods Should Microsoft 365 Users Use?

Not all authentication methods carry equal weight, and treating them as interchangeable is where a lot of otherwise solid rollouts lose their edge.

• Microsoft Authenticator with push notifications and number matching is the primary recommendation for most users. It's fast, free, and resistant to the simplest phishing attempts.
• FIDO2 security keys or passkeys belong on every admin and privileged account. Microsoft's own deployment guidance points administrators toward phishing-resistant methods precisely because credential theft targets privileged accounts first.
• OATH hardware tokens cover users without smartphones or in environments where personal devices aren't allowed.
• SMS and voice calls should be a fallback only, never the primary method, since they're the easiest to intercept.

Microsoft's own telemetry found that MFA blocks more than 99% of account compromise attempts when it's actually enforced across a tenant. That number only holds if registration is complete and legacy auth is dead. Require a second registered method per user wherever you can, turn on Self-Service Password Reset, and write down your lost-phone recovery process before the first help desk ticket comes in, not after.

How Should You Roll Out MFA Across the Organization?

A staged rollout beats a flip-the-switch approach every time, because it turns one big risk into several small, manageable ones.

1. Pilot with IT staff and a handful of power users first. Ten to fifteen people is enough to surface registration friction, broken legacy clients, and confusing prompts.
2. Move to critical business functions next: finance, executives, and anyone with access to sensitive systems.
3. Expand in department-sized waves, giving each group a defined registration window rather than an open-ended deadline.
4. Finish with the full remaining user base, once your help desk has already worked through the common issues.

Publish a short communications plan before wave one starts: what's changing, when, who to contact, and what to do if registration fails. Staged rollouts measurably reduce help desk load compared to organization-wide flips, largely because support tickets arrive in a trickle instead of a flood.

Keep a lightweight exception request process for the inevitable edge cases, log every exception with a reason and owner, and version your policy names (v1, v2) so you can trace changes back to a specific rollout wave.

Pro Tip: Send your registration reminder email on a Tuesday or Wednesday. Monday rollouts collide with weekend catch-up, and anything sent Friday gets ignored until the following week.

How Do You Verify MFA Is Working and Fix Problems Fast?

Enabling policies isn't the finish line. You need a way to confirm they're doing what you intended and a fast path to fix what breaks.

• Check sign-in logs and Conditional Access insights weekly during rollout to catch denied sign-ins before users start calling.
• Re-run the What If tool whenever you add a new app or user group, since policy interactions aren't always obvious from the policy list alone.
• For legacy clients that can't be modernized, scope a tightly limited exception with logging rather than exempting the whole app or department.
• After each wave, confirm admin accounts show MFA-protected sign-ins and review blocked legacy-auth attempts to spot devices you missed in your inventory.

The biggest post-enforcement mistake isn't a bad policy. It's finding out three weeks later that a scanner or a service account has been silently failing sign-ins the whole time because nobody routed the alert anywhere.

Route Conditional Access alerts to whoever owns IT support, not just an inbox nobody checks.

What Collett Systems Sees Managing MFA for Real Businesses

Collett Systems LLC manages Microsoft 365 Business Premium environments across Southeastern Wisconsin, and the pattern holds no matter the industry: businesses that skip the inventory step are the ones calling us mid-lockout.

• We run assessments that check licensing, map legacy authentication usage, and build a pilot plan before a single policy goes live.
• Our standard approach is assessment, then pilot, then phased enforcement, backed by 24/7 monitoring and documented emergency-account management.
• Teams that want a second set of eyes on readiness before flipping any switch can request an assessment to catch gaps early.

Why Most MFA Advice Skips the Part That Actually Causes Outages

Most guides treat MFA as a single toggle: turn it on, done. That framing misses where deployments actually go wrong. In our experience, it's never the MFA prompt itself that causes the support fire. It's the legacy scanner nobody inventoried, the break-glass account nobody created, or the policy that went straight to enforcement without a report-only dry run.

The conventional advice to "just enable Security Defaults" isn't wrong, but it's incomplete for any business past a handful of employees. It skips the part where you find out which of your line-of-business apps still authenticate with a protocol from 2015. That discovery should happen in report-only mode, not in a Tuesday morning outage.

If you take one thing from this guide, prioritize the emergency accounts and the legacy-auth inventory before you touch a single policy toggle. Everything else, method selection, rollout pacing, communications, is easier to fix after the fact than a locked-out tenant is to fix during one.

, Dustin Collett

Get a Microsoft 365 Assessment Before You Flip Any Switch

Reading the steps is one thing. Executing them across forty user accounts, a handful of legacy line-of-business apps, and a help desk that's already stretched thin is another. Collett Systems LLC runs a Microsoft 365 Environment Assessment built specifically for this moment: a full license review, a legacy-authentication inventory, a pilot plan mapped to your actual user groups, and emergency account setup done correctly the first time.

Once policies go live, our managed IT services team handles the ongoing side: 24/7 monitoring of sign-in activity, phased enforcement across your remaining waves, and emergency-account management so a lost phone never turns into a locked-out executive. Fixed per-user pricing means there's no separate line item for security monitoring bolted on later.

If your business is past the "just flip Security Defaults on" stage, book an assessment and get a documented rollout plan before your next policy change.

Sources

• Set up multifactor authentication for Microsoft 365
• What-if tool for Conditional Access - Microsoft Entra

FAQ

Is MFA Required for Microsoft 365?

Microsoft doesn't force every tenant into MFA by default, but Security Defaults, which Microsoft increasingly enables for new tenants, requires it automatically. Businesses with sensitive data or compliance obligations should treat it as mandatory regardless of the default setting.

How Do I Set Up MFA on My Office 365 Account?

Enable Security Defaults in the Microsoft 365 admin center under Entra ID properties for a fast baseline, or build Conditional Access policies from Microsoft's templates if you have Entra ID P1 or P2 and need more granular control.

How Do I Know if MFA Is Enabled in Office 365?

Check the Entra ID admin center for Security Defaults status, or review your Conditional Access policies list to see which ones are set to On versus report-only. Sign-in logs also show whether MFA was satisfied on recent authentications.

How Do I Update My Multi-Factor Authentication Settings in Office 365?

Users can update their own registered methods through the My Sign-Ins security info page. Admins manage tenant-wide method availability and enforcement through Conditional Access policies or the Security Defaults toggle.

Does Switching From Security Defaults to Conditional Access Cause Downtime?

Not if you build and test replacement policies in report-only mode before turning Security Defaults off. Skipping that step is the most common cause of unexpected lockouts during the transition.