All guides
Identity & AccessProtect accounts

Enable MFA on Microsoft 365

Turn on multi-factor authentication for every account in your tenant, starting with admins. This single change blocks the vast majority of automated account takeover attempts.

Read time
8 min
Audience
Microsoft 365 admins
Last reviewed
2026-09-15

Before you start

  • ✓Admin access to the Microsoft 365 admin center
  • ✓A smartphone or hardware key for each user

Steps

  1. 1

    Sign in to admin.microsoft.com with your admin account.

  2. 2

    Open Active users, select all admins first, then choose Multifactor authentication from the toolbar.

  3. 3

    In the per-user MFA panel, set each admin to Enabled, then have each admin complete MFA setup on their next sign-in.

  4. 4

    After admins are enrolled, enable MFA for all remaining users in batches to avoid helpdesk overload.

  5. 5

    In the MFA service settings page, disable app passwords unless you have legacy desktop clients that cannot use modern auth.

  6. 6

    Configure Conditional Access (Azure AD) to require MFA for all users when signing in from outside trusted locations.

  7. 7

    Document the recovery process for users who lose their second factor, and designate a backup admin with a hardware key.

References