How to Set Up MFA and Conditional Access in Microsoft 365: Step-by-Step Guide (2026)
Multi-factor authentication is the single most effective control against stolen passwords. This guide walks you through turning it on safely in Microsoft 365, in eight steps, without locking yourself or your staff out.
Before you start
What You Need and Why It Matters
Most account takeovers start with a stolen or guessed password. MFA stops the large majority of those attempts, because a password alone is no longer enough.
Permissions
A Global Administrator, Security Administrator or Conditional Access Administrator account in your Microsoft 365 tenant.
Licensing
Security defaults are free for every tenant. Conditional Access needs Microsoft Entra ID P1, included in Microsoft 365 Business Premium, E3 and E5.
A rollout plan
Decide who is covered, when you will enforce it, and how staff will get help. Plan one to two weeks from announcement to enforcement.
Small teams without Entra ID P1 can simply switch on security defaults in the Entra admin center and stop there. The steps below are for businesses that want finer control through Conditional Access. If you are unsure which applies, our Microsoft Entra ID guide explains the options.
The process
Eight Steps to Secure Sign-In
Follow them in order. Menu names in Microsoft's admin centers change from time to time, so use the wording below as a guide.
Step 1: Check what you already have
Know your starting point before you change anything.
- Sign in to the Microsoft Entra admin center (entra.microsoft.com) as a Global Administrator or Security Administrator.
- Check whether security defaults are on (Entra ID > Overview > Properties > Manage security defaults). Security defaults and Conditional Access cannot run together, so you will switch it off once your own policies are ready.
- Confirm your license: Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, E3 and E5.
- Export a list of users, admins and shared or service accounts so nobody is forgotten.
Step 2: Create two emergency access accounts
This is your safety net if a policy goes wrong.
- Create two cloud-only admin accounts that are not tied to a person, with long, unique passwords stored securely offline.
- Give them a role that can fix Conditional Access (Global Administrator) and exclude them from every policy you create.
- Set up an alert for any sign-in by these accounts, and test them every few months.
Step 3: Register users for Microsoft Authenticator
Policies are easier when people are already set up.
- Tell staff what is coming, when, and where to get help.
- Ask users to register at aka.ms/mysecurityinfo and add the Microsoft Authenticator app. Prefer app-based methods or passkeys over SMS.
- Review authentication methods in Entra (Protection > Authentication methods) and enable the ones you want to allow.
- Track registration so you can chase users who have not completed it.
Step 4: Create a policy requiring MFA for all users
The most important single policy.
- Go to Protection > Conditional Access > Policies > New policy.
- Users: include All users; exclude your two emergency accounts.
- Target resources: All resources.
- Grant: select Require multifactor authentication.
- Set Enable policy to Report-only first, then create the policy.
Step 5: Review the impact, then switch it on
Report-only mode shows who would have been affected without blocking anyone.
- Wait a few days, then review sign-in logs (Monitoring > Sign-in logs) and the Report-only results for each sign-in.
- Look for accounts that would fail: old service accounts, shared mailboxes, scripts and devices that cannot do MFA.
- Fix or exclude genuine exceptions, with a note of the reason and an owner.
- Change the policy to On during a quiet period, with your support team ready.
Step 6: Block legacy authentication
Old protocols cannot use MFA, so attackers target them.
- Create a new policy: Users: All users (exclude emergency accounts).
- Conditions > Client apps: select Exchange ActiveSync clients and Other clients.
- Grant: Block access. Run it in report-only mode first and check for older apps or printers still using these protocols.
Step 7: Protect administrators more strongly
Admin accounts are the highest-value targets.
- Create a policy targeting Directory roles (Global Administrator, Security Administrator, Exchange Administrator and similar).
- Require MFA, and where possible a phishing-resistant method such as passkeys or FIDO2 security keys.
- Use separate admin accounts that are not used for daily email and browsing.
- Note that Microsoft now requires MFA to sign in to its admin portals, so admins need it regardless. Check Microsoft's current requirements.
Step 8: Monitor, review and improve
MFA is not a one-off project.
- Review sign-in logs and Conditional Access insights monthly for failures and unusual locations.
- Consider next policies: require compliant or managed devices, restrict sign-ins by country, and, with Entra ID P2, risk-based policies.
- Remove users who left, review exceptions every quarter, and keep your emergency accounts tested.
- Link this work to your wider plan: see our Zero Trust guide and Defender for Business guide.
Avoid the pitfalls
Common Mistakes to Avoid
These cause most of the lock-outs and help-desk calls.
- Skipping emergency accounts, then getting locked out by a faulty policy
- Turning policies on without testing them in report-only mode
- Forgetting shared mailboxes, service accounts and scripts that cannot do MFA
- Relying on SMS codes when app-based or passkey methods are available
- Leaving legacy authentication open, which bypasses MFA entirely
- Never reviewing exceptions after the first rollout
For a full configuration review beyond MFA, download our free Microsoft 365 Security Checklist.
Approaching Your Enterprise Renewal Window? Audit your seat usage counts before your billing cycle hits. Grab our Free Microsoft 365 Security & Licensing Blueprint to cut seat waste.
Common questions
Frequently Asked Questions
Is MFA free in Microsoft 365?
Yes. Every Microsoft 365 tenant can turn on security defaults at no extra cost, which requires MFA for all users. Conditional Access policies, which give finer control, require Microsoft Entra ID P1, and that is included in plans such as Microsoft 365 Business Premium, E3 and E5.
What is the difference between security defaults and Conditional Access?
Security defaults is a one-click bundle of baseline protections that you cannot customize. Conditional Access lets you choose who is covered, which apps, which devices and locations, and what to require, so it suits businesses that need exceptions or stricter rules. You use one or the other, not both.
Which MFA method should we use?
Microsoft Authenticator app notifications with number matching are a good default. Passkeys and FIDO2 security keys are stronger because they resist phishing. SMS and voice calls are the weakest options and are best kept only as a fallback.
Can MFA lock us out of our own tenant?
It can if policies are misconfigured. That is why you should create two emergency access accounts, exclude them from policies, and test every new policy in report-only mode before switching it on.
How long does an MFA rollout take?
For a small business, setup of the policy takes under an hour, but allow one to two weeks for communication, user registration and fixing problems before you enforce it for everyone.
Rua Technologies Recommendation: If you would rather not risk a lock-out, we configure and test MFA and Conditional Access for you, including emergency accounts, rollout communication and staff support.
Talk to Rua TechnologiesConclusion
MFA and Conditional Access are quick to configure but easy to get wrong without a safety net. Create emergency accounts, test in report-only mode, block legacy sign-ins and give admins stronger protection. Done in that order, it takes a small business a few days from start to enforcement. As you add AI tools such as Copilot, these controls matter even more, as explained in our AI agents guide.
Keep reading
