What it is
Multi-factor sign-in (often called MFA) means a password isn’t enough to get into an account. After typing the password, you also approve the sign-in on your phone.
If someone steals or guesses a password, they still can’t get in without the phone. That stops most of the account break-ins we see.
Before you start
- You need to be a Global Administrator in Microsoft 365.
- Tell your team first. The next time they sign in, Microsoft will ask them to set up the Microsoft Authenticator app on their phone. It takes about five minutes each.
- Pick a quiet time, like a Monday morning, when you can help anyone who gets stuck.
The quick way: security defaults
Microsoft has a switch called security defaults that turns on MFA for everyone, along with a few other sensible protections. For most small businesses, it’s the right place to start.
- Go to the Microsoft Entra admin centre at entra.microsoft.com and sign in as an administrator.
- Open Identity, then Overview, then the Properties tab.
- Choose Manage security defaults.
- Set it to Enabled and save.
That’s it. Each person will be asked to set up the Authenticator app the next time they sign in. They get 14 days to do it.
Microsoft moves these menus around from time to time. If a step doesn’t match what you see, search the admin centre for “security defaults”.
When security defaults isn’t enough
If you already use Conditional Access (part of Microsoft 365 Business Premium), you can’t use security defaults at the same time. Conditional Access gives you finer control, like only allowing sign-ins from Australia, but it’s easy to lock yourself out. That’s a good time to ask us.
Don’t forget
- Shared mailboxes and old accounts. Delete accounts for people who’ve left. They’re a favourite way in.
- Backup admin account. Keep a second administrator account, with MFA, so you’re not stuck if your phone dies.
- Text messages are the weakest option. The Authenticator app is safer than SMS codes. Use it where you can.