5 min read · Intermediate · Related: Microsoft 365

Updated October 2026 · Tampa Bay–tested steps

Turn On MFA in Microsoft 365 First

MFA blocks nearly all password-based break-ins. Here's the setup order we use for Tampa small businesses.

  1. 1. Require the Microsoft Authenticator app (not SMS)

    In the Microsoft 365 admin center, go to Users → Active users → Multi-factor authentication, and enable it for each user. Have everyone install Microsoft Authenticator and approve a sign-in from the app instead of typing SMS codes — app approvals resist SIM-swap attacks that SMS doesn't.

  2. 2. Enforce it with a Conditional Access policy

    Per-user MFA can be skipped by legacy apps. Create a Conditional Access policy (Entra admin center → Protection → Conditional Access) that requires MFA for all users and all cloud apps. Exclude one emergency 'break-glass' admin account and store its credentials offline.

  3. 3. Disable legacy authentication

    Old email apps send passwords in ways MFA can't protect. In the same Conditional Access area, block legacy authentication protocols. If an ancient scanner or app breaks, that's the moment to replace it — not to leave the hole open.

  4. 4. Register backup methods

    Each user should register two methods (e.g. app + phone). When someone loses their phone on vacation, the second method is the difference between a 2-minute fix and a locked-out Monday.

Turn On MFA in Microsoft 365 First — When to Call a Pro

  • You have 5+ users and don't want to click through this one by one.
  • You need Conditional Access, compliance documentation, or a break-glass strategy.
  • Something already looks compromised (unknown sign-ins, forwarding rules you didn't create).
Get help with this(813) 702-3155

Guide FAQ

For the first day, slightly. After that, sign-ins on trusted devices remember them for weeks. The 30 seconds it occasionally costs beats explaining a breach to clients.
An admin revokes the old device's sessions and re-registers the new one — about 5 minutes. This is why the break-glass admin account and backup methods matter.
Yes — MFA rollout, Conditional Access, and license cleanup are core Microsoft 365 work. Remote setup starts at $75/hr, and most small teams are done in 1–2 hours.
Was this guide helpful?

Keep going on Microsoft 365

Switching From Google to Microsoft 3657 min readOneDrive Says Storage Full? Fix It Without Paying4 min read"File Is Locked for Editing" in Excel? Unlock It Properly3 min read

Related service: Microsoft 365 →