How do I turn on two-step sign-in for Microsoft 365?

The short version

• Security defaults are free and on by default in Microsoft 365 for business.
• They require two-step sign-in for everyone and block old sign-in methods.
• People register with the Microsoft Authenticator app and type a number shown on screen.
• Admins must use two-step sign-in every time. Microsoft also now requires it for admin centers.
• Business Premium can replace defaults with Conditional Access rules, but only on purpose.

What do security defaults switch on?

Microsoft’s security defaults page lists the basics:

• Every user must register for multifactor authentication (two-step sign-in).
• Administrators must use it.
• Users are asked for it when Microsoft judges it necessary, based on location, device, role and task.
• Legacy sign-in methods are blocked. That includes older mail protocols signing in with just a password.
• Device code sign-in is blocked.
• Access to admin tools such as the Microsoft Entra admin center needs two-step sign-in.

Microsoft’s business security overview says security defaults are on by default, so two-step sign-in is enabled by default in Microsoft 365 for business. Our answer on two-factor authentication explains why it matters in general. This page is the Microsoft 365 setup.

How do I check they’re on?

You need at least the Conditional Access Administrator role. Then:

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID, then Overview, then Properties.
3. Select Manage security defaults.
4. Check Security defaults is set to Enabled. If not, set it and select Save.

Expected result: the next time each person signs in, Microsoft asks them to set up two-step sign-in. Microsoft suggests signing everyone out after enabling it, so nobody skips registration.

How does each person set it up?

1. Install Microsoft Authenticator on their phone from the App Store or Google Play.
2. Go to myprofile.microsoft.com and select Security info, or simply sign in when prompted.
3. Follow the steps to add the Authenticator app, scanning the code on screen.
4. On future sign-ins, approve the prompt by typing the number shown on the computer.

Microsoft says that number check is there to stop people approving prompts they didn’t start. If a prompt arrives that you didn’t trigger, deny it and change your password.

What changed recently?

• No more 14-day grace period. Microsoft says that from July 29, 2024, new and existing tenants lost the 14-day window to register.
• Mandatory two-step sign-in for admin centers. Microsoft’s mandatory MFA page says enforcement for the Azure portal, Entra admin center and Intune admin center began in October 2024, and for the Microsoft 365 admin center from February 2025. There’s no opt-out.
• Device code flow blocked for all new tenants from July 1, 2026, as part of security defaults.

Should we use Conditional Access instead?

Only if you have Business Premium and a reason. Business Premium includes Entra ID P1, which brings Conditional Access: rules like “require two-step sign-in unless the person is on a company laptop.” Microsoft says organizations with P1 licenses probably won’t want security defaults. But you must turn defaults off to use Conditional Access, and then build the replacement rules straight away. Turning defaults off and forgetting the second step leaves you with less protection than before.

Why does it matter?

Email accounts are a favorite target because they can reset almost every other password. A stolen password alone isn’t enough when two-step sign-in is on. Microsoft also notes that legacy sign-in methods can’t do two-step sign-in, which is why blocking them is part of the package.

What are the common mistakes?

• Turning defaults off to fix one problem. Find the device or app that uses old sign-in and update it instead.
• One admin with no backup. If the only admin loses their phone, everyone waits. See who should be an admin.
• Shared logins. Two-step sign-in for a shared account usually goes to one person’s phone. Give each person their own account and use a shared mailbox.
• Approving prompts you didn’t start. Deny, then change the password.
• Sending codes to “support.” Microsoft, E-3 and any honest provider never need your code or password.

What if someone is locked out?

• New phone, old phone gone. An admin can require the person to register again. Never share your code with the admin to do this.
• Printer or old app stopped sending mail. It’s probably using an old sign-in method. Update it or set it up the way Microsoft’s multifunction-device guide describes.
• The only Global Administrator is locked out. Microsoft says another Global Administrator or a Privileged Authentication Administrator can reset them. Without one, you need Microsoft support.

How much does it cost, and how long does it take?

Security defaults are free on every plan. Each person needs about five minutes to set up the app. Conditional Access needs Business Premium or an Entra ID P1 license.

How does E-3 handle this?

Email setup and passwords is our single biggest support topic, at roughly 1,470 requests since 2019. E-3’s own SmarterMail server doesn’t currently offer two-factor sign-in, and Microsoft 365 does, which is one reason clients move. We set up business email with two-step sign-in and walk each person through their first sign-in. We never ask for your password or codes.

Related questions

• Who should be an admin in Microsoft 365?
• Should I turn on two-factor authentication?
• Why does Outlook keep asking for my password?
• Back to the complete Microsoft 365 guide

Sources

1. Configure security defaults for Microsoft Entra ID (Microsoft Learn)
2. Plan for mandatory Microsoft Entra multifactor authentication (Microsoft Learn)
3. Microsoft 365 for business security overview (Microsoft Learn)
4. About admin roles in the Microsoft 365 admin center (Microsoft Learn)