How to require MFA for everyone in Microsoft 365

Pick the method

• Security defaults: free in every tenant. Requires everyone to register MFA, challenges admins on every sign-in and blocks legacy authentication. Best for Business Basic and Standard
• Conditional Access: needs Entra ID P1, included in Business Premium. Lets you require MFA with exceptions, by location, device or app. Best for Business Premium
• Per-user MFA: the legacy method. Microsoft recommends moving to security defaults or Conditional Access

Roll it out

1. 1

   Tell people what's coming

   Explain that they'll be asked to set up the Microsoft Authenticator app and when.

2. 2

   Keep an emergency admin account

   One cloud-only Global Administrator, with a long password stored safely, excluded from Conditional Access so you can't lock yourself out.

3. 3

   Start in report-only mode

   With Conditional Access, run the policy in report-only mode first to see who it would affect.

4. 4

   Block legacy authentication

   Old protocols don't support MFA and are a common way around it.

5. 5

   Turn it on

   Enable security defaults or switch the Conditional Access policy to on.

6. 6

   Check coverage

   Look for anyone who hasn't registered a method and follow up.

Doing it with TenantWard

TenantWard shows MFA coverage person by person, recommends the right method for your license, creates Conditional Access policies in report-only mode first, and switches them on when you're ready, with a backup and undo.

Questions

Is MFA free in Microsoft 365?

Yes. Security defaults are free in every tenant. Conditional Access, which allows more control, needs Entra ID P1, included in Microsoft 365 Business Premium.