How to enable MFA in Microsoft 365 without downtime
The order in which to enable MFA in Microsoft 365 so that nobody loses access. We cover emergency access accounts, shared accounts and older applications.
To enable MFA in Microsoft 365 without downtime, leave switching it on until last. First, create emergency access accounts and check which devices sign in with older protocols. Then warn your staff and sort out shared accounts. Only then do you enable MFA: first for administrators, then for a test group and finally for everyone.
Multi-factor authentication (MFA) means signing in with a password and a second factor, such as a confirmation in an app on your phone. According to Microsoft, MFA together with blocking legacy authentication stops more than 99.9% of common identity attacks (security defaults in Microsoft Entra ID, as of 28 September 2026). Our Microsoft 365 security page lists the full set of protections we configure.
Step 1: security defaults or Conditional Access?
Microsoft 365 offers two ways to enforce MFA. Security defaults are free and switched on with a single toggle, but they cannot be customised: they apply to the whole organisation or not at all. Conditional Access lets you set policies for selected users, applications and devices. It requires a Microsoft Entra ID P1 licence, which is included in Microsoft 365 Business Premium and some other plans (Conditional Access licensing requirements).
| Security defaults | Conditional Access | |
|---|---|---|
| Licence | not required | at least Entra ID P1 |
| Rollout in stages | no | yes, for example a test group first |
| Exclusions for emergency access accounts | no | yes |
| Report-only mode before enforcement | no | yes |
| Requiring a managed device | no | yes, together with Intune |
You cannot use both at once. If you move to Conditional Access, turn on the policies that replace security defaults immediately after switching the defaults off.
Step 2: emergency access accounts
An emergency access (break-glass) account lets you regain access when a faulty policy or an MFA outage locks out every administrator. Microsoft recommends two such accounts: cloud-only, with the Global Administrator role and not assigned to a specific person (emergency access accounts in Microsoft Entra ID, as of 28 September 2026).
With Conditional Access, we exclude emergency access accounts from the policies (exclusions when blocking legacy authentication). A sign-in to one of them should trigger an alert. Security defaults allow no exclusions, so we make sure the emergency account’s MFA method does not depend on one person’s phone.
Step 3: older applications and devices
Older protocols such as IMAP, POP3 and SMTP authentication do not support MFA. Security defaults and a policy blocking legacy authentication cut them off, so anything that relies on them stops working. Typically this means:
- multifunction devices that scan to email
- software that sends notifications by email, for example from line-of-business systems
- scripts and service accounts
You can see who uses older protocols in the sign-in logs in the Microsoft Entra admin center, filtered by client app. For devices and software that send email, Microsoft describes secure alternatives (how to set up a multifunction device or application to send email using Microsoft 365). We switch them over before enabling MFA. Otherwise, on the first morning after the change, the scanner at reception stops sending documents.
Step 4: shared accounts and shared mailboxes
A shared account is an ordinary account, such as office@, that several people sign in to with one password. This does not work with MFA, because the second factor is usually on one person’s phone. We convert such an account into a shared mailbox. Each member of staff then opens it from their own account, with their own MFA.
A shared mailbox does not need a separate licence. Microsoft recommends that sign-in to its account is always blocked (shared mailboxes in Microsoft 365, as of 28 September 2026). Along the way, we check that no shared mailbox has sign-in enabled.
Step 5: telling your staff
Since 29 July 2024, security defaults no longer give users a 14-day grace period to register for MFA (security defaults, as of 28 September 2026). Staff must register MFA the first time they sign in after the change. That is why we warn people in advance. Microsoft provides ready-made communication templates for this.
Staff should know:
- the date the change takes effect
- that they need a phone with the Microsoft Authenticator app
- how to register a method under “Security info” in their account settings
- whom to call if sign-in does not work
We enable the change on a day when the helpdesk has time to take calls. We avoid Friday afternoons and the days just before month-end close.
Step 6: enabling in stages
With Conditional Access, start with the policies Microsoft provides as templates:
- MFA for administrators at every sign-in.
- MFA for a test group and, a few days later, for all users.
- Blocking legacy authentication.
- MFA for Azure, Entra and PowerShell management.
- Requiring a compliant device managed by Intune, only once the computers are in order.
We first run each policy in report-only mode. The logs show whom the policy would block. We enforce it when the list holds no unexpected names.
Which MFA method to choose?
For most staff, the standard is Microsoft Authenticator with push notifications and number matching. Administrators and people with access to finance should use phishing-resistant methods: FIDO2 security keys, passkeys or Windows Hello for Business. Text messages and voice calls do not protect against fake sign-in pages, so we treat them as a backup method.
Does Microsoft enforce MFA itself?
Partly, and only for administrators. Microsoft is introducing mandatory MFA for signing in to admin portals (mandatory MFA for Azure and admin portals, as of 28 September 2026):
- in phase 1, from October 2024 for the Azure portal, the Microsoft Entra admin center and Intune, and from February 2025 gradually for the Microsoft 365 admin center
- in phase 2, from 1 October 2025 for Azure CLI, PowerShell, the Azure mobile app and automation tools, with the option to postpone until 1 July 2026
Staff mailboxes and files are still protected only by your own configuration.
How much does enabling MFA in a company cost?
We quote the configuration individually. The cost depends on the number of users and on the devices and software that use older sign-in methods. It also matters whether we deploy Intune and Defender together with MFA. Our cybersecurity services page covers the other protections.
If you are only now moving your company to the cloud, see our Microsoft 365 rollout plan. MFA is easiest to enable during the rollout itself. The next layer is threat monitoring and incident response. To enable MFA in your company, get in touch.
