How to require MFA for all users in Microsoft 365
There are three ways to require multi-factor authentication in Microsoft 365, and which one you should use depends entirely on your licence. If you are on Business Basic or Business Standard, you want security defaults — it is free, takes four clicks, and covers every user. If you have Business Premium, E3 or E5, you want a Conditional Access policy, because it lets you exclude a break-glass account and tune the rules. Legacy per-user MFA still works but Microsoft is retiring it, so do not start there.
The mistake worth avoiding: having a policy that looks like it requires MFA while sitting in report-only mode, which enforces nothing. More on that below.
Option 1: Security defaults (no Entra ID P1 needed)
Security defaults enforce MFA for all users, require it immediately for administrators, and block legacy authentication at the same time. They are free on every plan, including Business Basic.
- Go to the Microsoft Entra admin center → Identity → Overview → Properties.
- Click Manage security defaults at the bottom.
- Set the toggle to Enabled and save.
Users are prompted to register the Microsoft Authenticator app at their next sign-in and get a 14-day grace period; administrators are prompted immediately with no grace period.
What breaks: security defaults also block legacy authentication, so anything using older protocols stops working — most commonly a printer or scanner sending mail with SMTP AUTH, or an old line-of-business app. Sort those out first (see the legacy authentication guide below). You also cannot exclude anyone, which is the main reason larger tenants move to Conditional Access.
Option 2: Conditional Access (Business Premium, E3, E5)
If you have Entra ID P1 — included with Business Premium, E3 and E5 — Conditional Access gives you the same enforcement with exclusions and granularity.
- Entra admin center → Protection → Conditional Access → Policies → New policy.
- Users: include All users. Under Exclude, add your break-glass account.
- Target resources: All resources (formerly "All cloud apps").
- Grant: Grant access → tick Require multifactor authentication.
- Set Enable policy to On, and save.
Create the break-glass account before you turn this on. It should be a cloud-only Global Administrator on the .onmicrosoft.com domain, with a long random password stored offline, excluded from every Conditional Access policy. Its entire purpose is to get you back in when a policy locks everyone out — including the policy you are about to create.
Microsoft also offers pre-built "security defaults-equivalent" policies under Protection → Conditional Access → Overview, which is a reasonable starting point if you would rather not build from scratch.
The report-only trap
Conditional Access policies have three states: On, Off, and Report-only. Report-only logs what would have happened and enforces nothing. It exists so you can test a policy safely, and it is the correct place to start — but a policy left there is a policy that does nothing.
This is the single most common finding on tenants that believe they have MFA enforced. The policy is named something confident like "Require MFA — all users", it appears in the list, and it is in report-only mode from a pilot nine months ago.
Check the State column on the policy list. If it says "Report-only", MFA is not enforced.
How to verify it actually worked
Enabling a policy and enforcing MFA are not the same thing. Two checks:
- Registration: Entra admin center → Protection → Authentication methods → User registration details shows who has actually registered a method. Users who have never signed in since you enabled the policy will still show as unregistered. (This view needs Entra ID P1.)
- Sign-in logs: Entra admin center → Identity → Monitoring & health → Sign-in logs, and look at the Conditional Access column on recent sign-ins to confirm the policy is being applied rather than skipped.
Pay particular attention to accounts holding administrative roles. An unregistered admin account is the gap that matters most, and it is easy to miss when the overall registration percentage looks healthy.
Questions
Can I require MFA on Microsoft 365 Business Basic?
Yes. Security defaults are free on every plan and enforce MFA for all users. You do not need Entra ID P1 unless you want exclusions, per-group targeting or conditional rules.
Does enabling security defaults break anything?
It blocks legacy authentication, so devices and apps using older protocols stop being able to sign in. The usual casualties are multifunction printers sending mail via SMTP AUTH and older line-of-business applications. Identify and migrate those first.
Should I exclude my admin account from MFA?
No. Exclude one dedicated break-glass account that nobody uses day to day, with a long random password stored offline. Your working admin account should have MFA like everyone else — admin accounts are the primary target.
Is this actually configured right in your tenant?
A read-only scan checks this and fifteen other things in about a minute, and shows you your grade and every finding for free. The full report with named accounts, costs and fixes is $79.
Scan my tenant →Click paths verified October 2026. Microsoft renames things in the admin centers regularly; the underlying settings are stable even when the menus move.