How to Switch On MFA for Every Microsoft 365 User in a Small Business

Before changing anything, sign in to the Microsoft Entra admin centre as a Global Administrator and look at what already exists. If your tenant has Conditional Access policies that require MFA, or per-user MFA settings from an earlier setup, enabling Security Defaults on top creates overlapping controls that are hard to troubleshoot. Review the Conditional Access policy list first and note any policy that already targets all users.

Make a short inventory of who signs in. Confirm every one of your 5 to 50 staff has an individual account, and list any shared mailboxes, meeting room accounts or service accounts that are used by software rather than a person. Shared and service accounts cannot complete an MFA prompt, so they need to be identified now rather than discovered when a scanner or line-of-business app stops working.

For many small tenants without Conditional Access, Security Defaults is the simplest route. In the Microsoft Entra admin centre, go to Identity, then Overview, then Properties, then Manage security defaults. Set Security defaults to Enabled and select Save. Microsoft has moved these menus before, so check the current path against its security defaults documentation if your portal looks different.

Security Defaults applies baseline protections to the whole tenant, including requiring users to register for MFA, so you cannot pick which users it covers. Once enabled, each user is prompted to register an authentication method, usually the Microsoft Authenticator app, at their next sign-in. Choose a quiet time to switch it on and tell staff in advance what the prompt will look like.

Security Defaults blocks legacy authentication, which affects older mail clients, some scanners that send email through Microsoft 365, and old devices that cannot use modern sign-in. Ask your IT provider or check each device and application that connects to mailboxes, and test with one pilot user and one administrator before the wider rollout. Anything that stops working needs to be moved to modern authentication or replaced.

Decide the recovery route for a lost or replaced phone before staff need it. A user who loses their phone cannot pass the MFA prompt, so an administrator will need to reset their registered methods and have them register again. Write down who can do this, how they will verify the person asking, and keep the process short enough that a locked-out member of staff is back in the same day.

Conditional Access gives finer control, such as requiring MFA for all users but with different rules for administrators, or blocking sign-in from certain locations. It requires a Microsoft Entra ID P1 licence, and Microsoft 365 plans differ in what they include, so confirm the licence assigned to your users in Microsoft's current licensing documentation rather than assuming it is covered.

Security Defaults and Conditional Access cannot run side by side. If you move to Conditional Access, you disable Security Defaults first and then build a policy that requires MFA for all users and all cloud apps, so there is no gap between the two. Test the policy in report-only mode where available, and keep one administrator account excluded and monitored so a policy mistake cannot lock the whole business out.

Administrator accounts carry the most risk. Keep at least two protected admin accounts, use them only for administration rather than daily email, and test your emergency access arrangement so you know it works. A single admin whose phone is lost or whose account is compromised can leave you unable to manage the tenant.

Shared mailboxes should have sign-in blocked so nobody uses them as an interactive login, and access should be granted through individual accounts instead. Service accounts used by software need to be documented, given long unique passwords, and moved to a method that does not depend on a human MFA prompt. Directors and finance staff are the most common targets for invoice fraud, so check their registered methods first and prefer the authenticator app over text messages where you can.