How do I turn on MFA without locking my team out?
Updated October 29, 2026
Before you change anything, make sure a second administrator can undo it. Turn on multi-factor authentication (MFA) for yourself first and live with it for a week or two. Once you’re sure you can get in, add the people who take change in stride, a few at a time, and save the person most bothered by changes to how they work for last. Everyone sets up a backup sign-in method before their turn.
Steps
- See what’s on today. In the Microsoft Entra admin center, check whether security defaults is on, and note which Microsoft 365 plan you have.
- List what still signs in the old way: older mail apps, and printers or scanners that send email. These can stop working once MFA is fully on.
- Set up a second administrator that doesn’t rely on your phone, and sign in with it once to prove it works.
- Turn MFA on for yourself only. Use it for a week or two on your phone, laptop, Outlook, and Teams.
- Have each person add a backup sign-in method on their Security info page before MFA is required for them.
- Add people a few at a time, starting with whoever is most flexible and quickest to tell you what’s off. The person most sensitive to workflow changes goes last.
- Once everyone is on, close the gap: switch to the setting that covers everyone and blocks older sign-ins.
- Write it down: where the second admin’s sign-in is kept, who’s done, and the new-phone rule: set up the new phone before wiping the old one.
Details
Check what’s already on
Microsoft turns security defaults on for many newer Microsoft 365 accounts, so MFA may already be required. Look in the Microsoft Entra admin center under Entra ID, Overview, Properties, Manage security defaults (Microsoft: Security defaults). If it’s on, your job is the backup methods and the second administrator. If it’s off, read the next section before you switch it on.
Everyone at once, or one at a time?
Security defaults is free, but it’s one switch for the whole company, with no way to try it on one person. Microsoft’s free way to go one person at a time is per-user MFA, under Users, All users, Per-user MFA (Microsoft: Per-user MFA). Microsoft calls it a legacy option and doesn’t recommend it long term, so use it for the rollout, then move on. If your plan is Business Premium, Conditional Access is already included: aim a rule at a small group and run it in report-only mode first. Use what you already pay for before buying anything.
Why you go first, and who goes last
Going first means you see every prompt your team will see, on your own phone and computer, before anyone else does. The second administrator is your way back: if something goes wrong, they can turn it off for you. In our experience, a week or two is long enough to hit the things you only do now and then. Next come the people who shrug off small hiccups and tell you about them quickly. Schedule the person most bothered by changes last, not never. By then the rough edges are gone, and a bad first experience is the hardest thing to undo.
Older mail apps and the office scanner
Microsoft says older sign-in methods, like those used by older versions of Outlook and some mail apps and devices, don’t support MFA and can be used to get around it. Security defaults blocks them. Per-user MFA doesn’t: those apps can keep signing in with an app password, a separate password that skips the second step. Before your final switch, find anything that still signs in the old way, such as a scanner that emails documents, and get it updated or changed over first.
A backup method for every person
Microsoft recommends more than one sign-in method per person, so a lost or replaced phone doesn’t lock anyone out. Each person adds methods at myprofile.microsoft.com, under Security info. MFA also brings a new office rule: before anyone wipes or trades in a phone, they set up the new one first. Add it to your new-phone checklist now.
What to write down, and what to leave alone
Turning MFA on takes minutes. Most of the calendar is waiting: your week or two, then each person’s turn. So start your own trial now, even if the team won’t start for a few weeks. Keep a one-page note: where the second administrator’s sign-in is stored, who has a backup method, and who’s switched over. Per-user MFA has to be turned on for each new hire, which is easy to forget, so finish on a setting that covers everyone. Microsoft says to turn off per-user MFA before you switch to security defaults or Conditional Access. Passkeys for everyone and fine-tuned rules can wait. If an insurance form got you started, see what cyber insurance asks about MFA. This isn’t insurance or legal advice.
Where doing it yourself gets risky
- Testing on your only administrator account, with no second way in.
- A “second” administrator that uses the same phone as the first.
- Switching security defaults on for everyone at once before checking who has a backup method.
- Stopping at per-user MFA, with older mail apps still getting around it.
- Exempting a busy or senior person instead of scheduling them last.
Signs it’s time for help
You can do most of this yourself. It’s time to get help if:
- You’re the only administrator and aren’t sure how to set up a second one safely.
- A printer, scanner, or older program sends email and you don’t know how it signs in.
- An insurance or client deadline is close and several people haven’t set up MFA yet.
Today, check whether security defaults is on and whether you have a working second administrator. If you’d like help planning the order, we’re glad to go through it with you.
Book a free 20-minute fit check