How do you turn on two-step verification for everyone in Microsoft 365?

What are security defaults?

They are a ready-made bundle of protections included free with Microsoft 365. You don't configure rules one by one: it is either on or off. Microsoft states that multifactor authentication, together with blocking old sign-in protocols, stops more than 99.9% of common attacks against accounts.

When it is on:

• every user must register a second verification method (normally the Microsoft Authenticator app);
• administrators must use it at every sign-in;
• everyone else is asked for it when Microsoft considers it necessary, based on location, device and operation;
• old sign-in methods that cannot support a second factor are blocked;
• access to Azure and the Entra admin centre always requires verification.

Is it already on in your company?

Possibly. Microsoft turns it on automatically for tenants (your company's environment in Microsoft 365) created on or after 22 October 2019, if you have no Conditional Access policies and no premium licences. Checking takes a minute, as described in the next section.

If your company has Microsoft Entra ID P1 or P2 licences (included, for example, in some Business Premium plans), Microsoft recommends using Conditional Access instead: it is more flexible, but it has to be configured.

How do you turn it on?

You need an account with at least the Conditional Access Administrator role; a global administrator will do.

1. Sign in to https://entra.microsoft.com with the administrator account.
2. Open Entra ID → Overview → Properties.
3. Select Manage security defaults.
4. Set Security defaults to Enabled.
5. Select Save.

If you can't find the menu or the option is locked, your company is probably already using Conditional Access.

Before saving, warn your colleagues: the first time they open Outlook, Teams or the portal they will have to register the second factor. Since Microsoft removed the 14-day grace period, registration is required straight away. People who are already signed in may see nothing until they sign in again: the administrator can force a new sign-in by revoking active sessions.

How does each employee register the second factor?

At the More information required prompt, each person follows these steps:

1. Select Next: the Keep your account secure wizard opens.
2. Install the Microsoft Authenticator app on the phone (Download now button), then select Next on the computer.
3. In the app, allow notifications, add an account and choose Work or school account.
4. Allow camera access and scan the QR code shown on the computer. If it can't be read, choose Can't scan the QR image and enter the code and URL by hand.
5. Approve the test notification that arrives on the phone and select Next.

Anyone who prefers a different code app can choose I want to use a different authenticator app. Later, when a notification shows a number, you have to type that number into the app: this prevents careless approvals. Anyone changing phone should register the new device at https://myprofile.microsoft.com, under Security Info, before getting rid of the old one.

What might stop working?

Blocking old protocols is the part that causes most surprises. These may stop:

• very old mail programs, such as Office 2010, or accounts connected through POP, IMAP or SMTP with just a password;
• scanners and multifunction printers that send scans by email using the username and password of a Microsoft 365 mailbox (SMTP with basic authentication);
• old business applications that send email the same way.

Before turning it on, list the devices that send email. Microsoft describes alternatives for these cases, such as sending through a connector (SMTP relay) with a fixed IP address, or High Volume Email if the recipients are internal only. If the device supports none of them, consider replacing it.

What should you do straight afterwards?

• Check that every user has completed registration.
• Don't disable verification methods in your company's settings while security defaults are on: you could lock yourself out of your own tenant.
• Use a separate account for administration and one for daily work, so the administrator is prompted for verification less often.
• Microsoft also recommends two cloud-only emergency accounts with the global administrator role, for cases where the other administrators get locked out.

Sources

• Security defaults in Microsoft Entra ID
• Set up security info from a sign-in page
• How to set up a multifunction device or application to send email using Microsoft 365 or Office 365

Need a hand at your company?

I provide IT and AI consulting for small businesses and professionals, in Apulia and remotely.

Services

Guide written with AI assistance and checked by me before publication.