Enable MFA in Microsoft 365 (Microsoft Entra ID)

What you need before step 1

Applies to: Microsoft Entra ID for Microsoft 365 tenants: security defaults (any licence) and Conditional Access (Microsoft Entra ID P1 or P2), as documented by Microsoft

14 steps

1. 1

   Create two emergency access (break-glass) accounts

   Where: Microsoft Entra admin center (https://entra.microsoft.com) > Entra ID > Users

   Sign in as a Global Administrator. Select New user > Create new user and create two cloud-only accounts on your contoso.onmicrosoft.com domain, for example breakglass1@contoso.onmicrosoft.com. Do not use a federated or synchronised account. Assign each one the Global Administrator role. If you use Privileged Identity Management, make the assignment active and permanent, not eligible. Do not link the accounts to any person's phone.

   You should see: Both accounts appear under Entra ID > Users with the Global Administrator role listed on their Assigned roles page.
2. 2

   Give the break-glass accounts a passkey and a group

   Where: Microsoft Entra admin center > Entra ID > Authentication methods, then a private browser window signed in as each break-glass account

   Microsoft recommends a passkey (FIDO2) security key, or certificate-based authentication if you already run a PKI. Enable the Passkey (FIDO2) method for the accounts, then sign in as each account at https://aka.ms/MySecurityInfo and register its security key. Create a security group named EmergencyAccess under Entra ID > Groups and add both accounts. Store the keys in separate secure places that several administrators can reach.

   You should see: Each account's Security info page lists a passkey. The EmergencyAccess group shows two members.
3. 3

   Check what is protecting the tenant now

   Where: Microsoft Entra admin center > Entra ID > Overview > Properties

   Select Manage security defaults and note whether Security defaults is Enabled or Disabled. Then open Entra ID > Conditional Access > Policies and note any existing policies, including Microsoft-managed ones. Tenants created on or after 22 October 2019 may already have security defaults on.

   You should see: You know which model is in use: security defaults Enabled, or Disabled with Conditional Access policies listed.
4. 4

   Pick security defaults or Conditional Access

   Where: Your own licence list (Microsoft 365 admin center > Billing > Your products)

   Use security defaults if you have no Microsoft Entra ID P1 or P2 licences: it is on or off with no exclusions. Use Conditional Access if you have P1 or P2: you can exclude break-glass accounts and the sync account, target admins separately and test in report-only mode. You cannot run both; Microsoft says organisations that move to Conditional Access must disable security defaults. For security defaults go to step 5; for Conditional Access go to step 7.

   You should see: A decision recorded in your migration plan.
5. 5

   Option A: turn on security defaults

   Where: Microsoft Entra admin center > Entra ID > Overview > Properties > Manage security defaults

   Sign in as at least a Conditional Access Administrator. Set Security defaults to Enabled and select Save. This requires all users to register for MFA (Microsoft Authenticator notifications), requires MFA for admin roles at every sign-in, prompts users for MFA when Microsoft judges it necessary, blocks legacy authentication protocols, blocks device code flow and requires MFA for the Azure portal, Entra admin center, Azure PowerShell and Azure CLI. Do not disable authentication methods while security defaults are on; Microsoft warns this can lock you out.

   You should see: The pane closes and Security defaults shows Enabled. Users are asked to set up their account at their next sign-in.
6. 6

   Option A: revoke existing sessions so users register now

   Where: PowerShell 7 or Windows PowerShell 5.1 on your admin PC with Microsoft Graph PowerShell installed

   Microsoft says administrators should revoke existing tokens after enabling security defaults so signed-in users must authenticate again and register. Connect with Microsoft Graph PowerShell (see install Microsoft Graph PowerShell), check the permission the cmdlet needs, then revoke per user. Start with a pilot user.

   Find-MgGraphCommand -Command Revoke-MgUserSignInSession | Select -First 1 -ExpandProperty Permissions
   Connect-MgGraph -Scopes "User.ReadWrite.All"
   Revoke-MgUserSignInSession -UserId user@contoso.com

   You should see: The command returns without an error. The user is asked to sign in again and is taken to the Microsoft Authenticator setup.
7. 7

   Option B: disable security defaults

   Where: Microsoft Entra admin center > Entra ID > Overview > Properties > Manage security defaults

   Only if you chose Conditional Access. Set Security defaults to Disabled (not recommended), choose a reason and select Save. Create the policies in the next steps straight away: Microsoft says organisations should immediately enable Conditional Access policies after disabling security defaults.

   You should see: Security defaults shows Disabled.
8. 8

   Option B: require MFA for all users

   Where: Microsoft Entra admin center > Entra ID > Conditional Access > Policies > New policy

   Name it, for example CA001 Require MFA all users. Under Users or workload identities > Include select All users. Under Exclude > Users and groups select the EmergencyAccess group; if you use Microsoft Entra Connect or Cloud Sync, also select Directory roles > Directory Synchronization Accounts. Under Target resources > Resources > Include select All resources. Under Grant select Grant access > Require authentication strength > Multifactor authentication strength > Select. Set Enable policy to Report-only and select Create.

   You should see: The policy is listed with State Report-only.
9. 9

   Option B: require stronger MFA for administrators

   Where: Microsoft Entra admin center > Entra ID > Conditional Access > Policies > New policy

   Name it, for example CA002 Require phishing-resistant MFA admins. Under Include select Directory roles and pick at least Global Administrator, Exchange Administrator, SharePoint Administrator, User Administrator, Security Administrator, Conditional Access Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Authentication Administrator, Helpdesk Administrator, Password Administrator, Billing Administrator, Application Administrator and Cloud Application Administrator. Exclude the EmergencyAccess group. Target All resources, and under Grant choose Require authentication strength > Phishing-resistant MFA strength. Set it to Report-only and Create. Microsoft cautions that admins must register a phishing-resistant method first or you risk locking yourself out.

   You should see: A second Report-only policy appears in the list.
10. 10

    Option B: review report-only results and switch the policies on

    Where: Microsoft Entra admin center > Entra ID > Conditional Access > Policies > (policy) > Policy impact, and Entra ID > Monitoring & health > Sign-in logs

    Open each policy and check the Policy impact tab where it is shown. In Sign-in logs, filter by Conditional Access or Username, select a sign-in and open its Conditional Access tab to see how each policy was evaluated. Look for migration tool accounts, scanners and apps. When the results are what you expect, open each policy, set Enable policy to On and select Save.

    You should see: Both policies show State On. A test user signing in is asked for MFA; a break-glass account is not blocked.
11. 11

    Nudge users to set up Microsoft Authenticator

    Where: Microsoft Entra admin center > Entra ID > Authentication methods > Registration campaign

    Sign in as at least an Authentication Policy Administrator and select Edit. Set State to Microsoft managed (Microsoft picks the method and snooze settings) or Enabled (you pick Microsoft Authenticator or Passkey, Days allowed to snooze from 0 to 14 and Limited number of snoozes). Include all users or a pilot group, exclude the EmergencyAccess group and select Save. For the Authenticator campaign, Microsoft Authenticator must be enabled in the authentication methods policy with Authentication mode set to Any or Push.

    You should see: The Registration campaign page shows your State, method and included groups. Eligible users see a prompt to set up Authenticator after their next MFA sign-in.
12. 12

    Tell users how to register

    Where: Each user, in a browser on their computer and the Microsoft Authenticator app on their phone

    Send users to https://aka.ms/MySecurityInfo. They sign in, select Add sign-in method, choose Microsoft Authenticator, install the app from their phone's app store when prompted, then scan the QR code shown on screen. Under security defaults users can register only with the notification option. With number matching, sign-in shows a number that the user types into Authenticator.

    You should see: The user's Security info page lists Microsoft Authenticator, and a test sign-in shows a number to enter in the app.
13. 13

    Check registration across the tenant

    Where: Microsoft Entra admin center > Entra ID > Authentication methods > Activity (needs P1 or P2)

    Open the Registration tab and select User registration details. Filter MFA Capable to Not Capable to find users who have not registered. Microsoft says the report updates for most users within 36 hours. Chase those users before migration day.

    You should see: A list of users with MFA Capable, Methods registered and Last Updated Time. Every migrating user shows Capable.
14. 14

    Test the migration admin account and tools

    Where: A private browser window and the admin PC you will migrate from

    Sign in with the account your migration will use and complete MFA. Connect the tools you plan to use (for example Exchange Online PowerShell) with interactive sign-in. Under security defaults, device code sign-in such as Connect-ExchangeOnline -Device is blocked, and any tool that signs in to Microsoft 365 with IMAP, POP3 or SMTP basic authentication is blocked. Sign in to each break-glass account once to prove it works.

    Connect-ExchangeOnline -UserPrincipalName admin@contoso.com
    Get-AcceptedDomain

    You should see: You complete MFA and the tool connects. Get-AcceptedDomain lists your domains. Both break-glass accounts sign in with their passkeys.

Expert tips

How to confirm it worked

• Entra ID > Overview > Properties > Manage security defaults shows Enabled, or Entra ID > Conditional Access > Policies shows your MFA policies with State On.

• Sign in as a test user in a private window: you are asked to approve a sign-in in Microsoft Authenticator by entering the number shown.

• Entra ID > Authentication methods > Activity > User registration details shows MFA Capable for migrating users (P1 or P2 tenants).

• Each break-glass account signs in with its passkey and is not blocked. In Sign-in logs, open its sign-in and check Conditional Access shows the policies as Not applied.

How to reverse it

Errors you might see

Questions

Official sources

Vendors change menus and requirements. Confirm on the source before you rely on a detail. Last checked 4 Nov 2026.