How to Enable MFA in Microsoft 365: Security Defaults, Conditional Access and a List of Users Who Have Not Registered

The short version: There are two supported ways to require MFA for everyone in Microsoft 365. Security defaults is one switch with no options, and it suits tenants without Microsoft Entra ID P1. Conditional Access lets you choose who is covered and who is excluded, and Microsoft states that Microsoft 365 Business Premium customers can use it. Pick one, never run both at once, then export the list of users who have not registered so you can chase them.

This guide is for the person who administers a Microsoft 365 tenant for a small or mid-sized company. By the end you will have MFA enforced, a staged rollout plan for your users, and, if your tenant has Entra ID P1 or P2 (Microsoft 365 Business Premium includes P1), a CSV of every account that has no MFA method registered. Steps were checked against Microsoft Learn on 28 October 2026.

Choose the method first

Security defaults

• What it does: requires all users to register for MFA, requires administrators to use MFA, prompts other users when Microsoft decides it is necessary, blocks legacy authentication protocols, blocks device code flow, and protects access to Azure management tools.
• Customisation: none. It is on or off.
• Licence needed: none beyond your Microsoft 365 subscription.
• Best for: tenants with no Conditional Access policies and no Entra ID P1 licences.

Conditional Access

• What it does: applies the policies you build, such as "require MFA for all users", with exclusions for emergency accounts and service accounts.
• Customisation: full. You choose users, apps, conditions and grant controls.
• Licence needed: Microsoft Entra ID P1, or Microsoft 365 Business Premium.
• Best for: any tenant that has the licence. Microsoft says security defaults is probably not right for organisations with P1 or P2 licences.

Security defaults and Conditional Access are meant to replace each other. Microsoft's instruction is to disable security defaults before you rely on Conditional Access policies.

Option A: turn on security defaults

You need at least the Conditional Access Administrator role.

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com).
2. Go to Entra ID > Overview > Properties.
3. Select Manage security defaults.
4. Set Security defaults to Enabled.
5. Select Save.

Before you save, make sure no administrator or application still depends on legacy authentication, because security defaults blocks it. Ask every administrator to sign in straight after you enable it so they can register a method. Microsoft also advises revoking existing sign-in tokens with the Revoke-MgUserSignInSession cmdlet so that users who are already signed in are forced through registration.

Users register at https://myprofile.microsoft.com by selecting Security Info. Under security defaults the registration option is the Microsoft Authenticator app with notifications. Users can also use verification codes from Authenticator or any OATH TOTP app.

Do not disable authentication methods for the organisation while security defaults is on. Microsoft warns that this can lock you out of the tenant.

Option B: require MFA with Conditional Access

First create two emergency access accounts. Microsoft recommends cloud-only accounts on the onmicrosoft.com domain, with the Global Administrator role assigned permanently and a passkey (FIDO2) as the sign-in method. Put them in a group such as EmergencyAccess so you can exclude one group from every policy.

Then build the policy. You need at least the Conditional Access Administrator role.

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Conditional Access > Policies, and select New policy.
3. Name it clearly, for example "CA001 Require MFA all users".
4. Under Assignments > Users or workload identities, include your pilot group for now (see "Roll it out in stages"). Change it to All users at the end of week 4.
5. Under Exclude, add the emergency access group. If you use Microsoft Entra Connect or Cloud Sync, also exclude the directory role Directory Synchronization Accounts.
6. Under Target resources > Resources, include All resources (formerly 'All cloud apps').
7. Under Access controls > Grant, select Grant access, then Require authentication strength, then the built-in Multifactor authentication strength.
8. Set Enable policy to Report-only and select Create.
9. After you have reviewed the results (see "How to check it worked"), change Enable policy to On for the pilot group. Add the next wave when the last one is stable, and switch to All users in the final wave.

If the tenant is on security defaults, disable it first: Entra ID > Overview > Properties > Manage security defaults > Disabled (not recommended) > Save.

Microsoft may also have created its own Conditional Access policies in your tenant, such as "Multifactor authentication for all users". Open the policy list and look for rows where the Created by column says Microsoft. They are created in Report-only state, and Microsoft turns them on no less than 30 days after introduction if you leave them alone, with notice about two weeks before. Decide whether to use those or your own, and do not leave two overlapping policies undocumented.

Roll it out in stages

1. Week 0: create the emergency accounts, test that they can sign in, and write the helpdesk script and the user instructions.
2. Week 1: administrators only. Create a separate policy that includes Directory roles instead of All users, with the same exclusions (steps for policy CA002 are in Conditional Access baseline policies), and confirm each admin has registered.
3. Week 2: a pilot group of 10 to 20 users from different departments, with a registration reminder. Report-only never prompts anyone to register, so registration comes from the reminder or from enforcement.
4. Weeks 3 and 4: the rest of the company in waves by department, with the helpdesk ready on each wave's first morning.
5. Last: guests and service accounts. Replace user accounts that act as service accounts with workload identities where you can.
6. After cut-over: check the unregistered list weekly until it is empty.

Tell users in advance what will appear on screen: they will be asked to set up Microsoft Authenticator and to approve sign-ins by entering the number shown on the sign-in screen.

Export users who have not registered

This uses Microsoft Graph PowerShell, not the retired MSOnline or AzureAD modules. The signed-in account needs a role that can read the report, such as Reports Reader, Security Reader or Global Reader. This export needs Microsoft Entra ID P1 or P2 (Microsoft 365 Business Premium includes P1), because Microsoft states that a P1 or P2 licence is required for the authentication methods activity data. If you run on security defaults alone, no tenant-wide list is available to you. Security defaults already requires every user to register at sign-in, so track progress by asking department heads to confirm that their staff have registered at https://myprofile.microsoft.com, and watch the helpdesk queue in the first weeks.

Install-Module Microsoft.Graph.Reports -Scope CurrentUser
Connect-MgGraph -Scopes "AuditLog.Read.All"

Get-MgReportAuthenticationMethodUserRegistrationDetail -All `
  -Filter "isMfaRegistered eq false" |
  Select-Object UserPrincipalName, UserDisplayName, UserType, IsAdmin,
    IsMfaRegistered, IsMfaCapable, MethodsRegistered |
  Export-Csv .\mfa-not-registered.csv -NoTypeInformation

The first Connect-MgGraph run asks you to consent to the AuditLog.Read.All permission, and someone allowed to grant that consent must approve it.

To find users who registered a method that your authentication methods policy does not allow, change the filter to isMfaCapable eq false. To review administrators first, add | Where-Object IsAdmin before Select-Object.

The same data is in the admin center under Entra ID > Authentication methods > Activity > Registration. Microsoft notes the report can be up to 36 hours behind, and that deleted and disabled users are not listed.

Common mistakes

1. Running security defaults and Conditional Access together. Disable security defaults first.
2. No emergency account. One bad policy can lock every administrator out. Create two accounts and exclude them from policies that block or restrict sign-in.
3. Turning on per-user MFA as well. Microsoft no longer recommends per-user MFA. Under security defaults or Conditional Access, a per-user status of Disabled is normal.
4. Forgetting legacy authentication. Old mail clients and scanners that use IMAP, POP3 or SMTP basic authentication cannot do MFA. Find them in the sign-in logs before cut-over.
5. Skipping report-only. You cannot see who would be affected until you look at the report-only results.
6. Treating the first sign-in as the finish line. A user who has not registered is a ticket waiting to happen. Work the unregistered list every week.

How to check it worked

1. Open Entra ID > Monitoring & health > Sign-in logs and open an interactive sign-in from a pilot user.
2. Read the Conditional Access tab (or the Report-only tab while the policy is in report-only) to see which policy applied and whether it succeeded.
3. Sign in as a test user in a private browser window. You should be asked to register or approve.
4. If your tenant has P1 or P2, re-run the PowerShell export each week. The CSV should shrink and end empty.
5. Sign in with an emergency account to prove it still works, then record the date.
6. Open Microsoft Secure Score (security.microsoft.com/securescore). With security defaults on, Microsoft says the recommended actions for MFA for all users, MFA for administrative roles and blocking legacy authentication are awarded in full.

FAQ

How do I enable two-factor authentication for email in Outlook?

You do not turn it on inside Outlook. MFA applies to the Microsoft 365 account, so once security defaults or a Conditional Access policy is on, Outlook asks for the second step at sign-in. Old clients that use basic authentication stop working and must be replaced.

How does MFA work in Microsoft 365?

After the user enters a password, Microsoft asks for a second proof, such as approving a notification in Microsoft Authenticator. Under security defaults Microsoft decides when to ask, based on factors such as location, device, role and task.

How do I use Microsoft Authenticator?

Go to https://myprofile.microsoft.com, select Security Info, and add the Authenticator app. At sign-in the app shows an approval request with a number that the user enters in the app. Users can also use verification codes from the app.

How do I enforce MFA for all users in Microsoft 365?

Use security defaults (Entra ID > Overview > Properties > Manage security defaults) or a Conditional Access policy that includes All users and requires multifactor authentication. Then export the unregistered users with PowerShell and follow up until the list is empty.

What if MFA sign-in fails or a user cannot complete it?

Open the failed sign-in in the sign-in logs and read the failure reason and the Conditional Access tab. If every administrator is locked out, use the emergency access account, which is why it must be excluded from the policy.

Next step

If you want an independent check of how MFA, Conditional Access and the rest of your tenant are configured, see the Microsoft 365 security audit, and read the Microsoft 365 security checklist and the MFA rollout for a Hong Kong accounting firm.

If you would rather know the price of a full review before you start, what a Microsoft 365 security audit costs sets out the fixed prices by headcount.