Set up multi-factor authentication in Microsoft 365

Multi-factor authentication (MFA) means signing in needs your password and a tap on your phone, which stops the vast majority of account takeovers. In Microsoft 365 Business Basic and Standard, the free way to turn it on for everyone is security defaults. This guide shows how to check it's on and how your staff set up the Microsoft Authenticator app.

• Applies to: Microsoft 365 Business Basic, Standard and Premium
• Time: 5 minutes for the admin, plus 5 minutes per user
• Difficulty: Beginner

Before you start

• You need to be a Global Administrator (or Conditional Access Administrator) to change security defaults.
• Each person needs a smartphone to install the free Microsoft Authenticator app (iPhone or Android).
• Tell your staff it's coming. Once it's on, each person must set up the app the next time they sign in. There's no longer a 14-day grace period to put it off.
• List anything that sends email by logging in with just a username and password, such as scanners, printers, website contact forms or old accounting software. Security defaults blocks these (see below).

What security defaults does

• Requires every user to register for MFA with the Microsoft Authenticator app.
• Asks for MFA when Microsoft judges it necessary, such as a new device or location, and every time an admin signs in.
• Blocks "legacy authentication": old apps and protocols (IMAP, POP3, basic SMTP and Office 2010-era clients) that can't do MFA and are the usual way attackers break in.

Microsoft 365 subscriptions set up since late 2019 usually have security defaults switched on already. It's worth checking, especially on older tenants.

Step-by-step: check or turn on security defaults

1. Open the Entra admin centre. Go to entra.microsoft.com and sign in with your Microsoft 365 admin account.
2. Find the properties page. Go to Entra ID → Overview, then open the Properties tab.
3. Open the setting. At the bottom of the page select Manage security defaults.
4. Turn it on. Set Security defaults to Enabled and select Save. If it already says Enabled, you're done.

What your staff do: set up Microsoft Authenticator

1. Install the app. On their phone, install Microsoft Authenticator from the App Store or Google Play.
2. Sign in on a computer. Go to office.com and sign in. When they see More information required, select Next. The Keep your account secure wizard opens.
3. Add the account in the app. Select Next on the computer until a QR code appears. In Authenticator, choose Add account → Work or school account and scan the QR code shown on the computer.
4. Approve the test. The computer shows a two-digit number. Type it into the app when it asks, and approve.
5. Finish. Select Done. From now on, when Microsoft asks, they'll type the number shown on screen into the app.

Staff can check or change their methods later, for example after getting a new phone, at myprofile.microsoft.com → Security info.

Printers, scanners and apps that send email

Security defaults blocks devices that sign in to smtp.office365.com with only a username and password. If your scanner's "scan to email" stops working after you turn security defaults on, that's why. Don't turn security defaults off to fix it. Instead, set the device up using one of the methods in Scan-to-email from a printer with Microsoft 365, such as direct send or an SMTP relay connector.

Old email programs that only support IMAP or POP3 with a password (for example, very old versions of Outlook or Thunderbird without modern sign-in) will also stop working. Current versions of Outlook, Apple Mail and the Outlook mobile app work normally.

Troubleshooting

The setting is greyed out or says Conditional Access is in use

Your tenant uses Conditional Access policies (available on Business Premium) instead. You can't use both. Keep Conditional Access and make sure it has a policy that requires MFA for all users.

A user isn't being asked to set up MFA

Ask them to sign out completely and sign in again at office.com in a private browser window. Existing sessions keep working until they sign in again.

A user has lost their phone and can't sign in

An admin can require the user to register their security info again. If you're not sure how, open a ticket and we'll talk you through it. Reset their password at the same time if you think the phone was stolen (see Reset a user's password).

Outlook keeps asking for a password after MFA was turned on

Older Outlook profiles may still be trying basic sign-in. Update Outlook, then remove and re-add the account. See Outlook keeps asking for a password.

Last reviewed: October 2026