How to enable two-factor authentication (2FA) for Microsoft 365 accounts
Summary
This guide helps you troubleshoot and resolve: How to enable two-factor authentication (2FA) for Microsoft 365 accounts. Follow the steps below to fix the issue.
Common Causes
Two-factor authentication (2FA) adds an extra layer of protection to your Microsoft 365 account by requiring a second verification step when you sign in. This guide explains how to enable multi-factor authentication (MFA) for Microsoft 365 accounts, outlines the different enforcement methods available, and provides steps for administrators and end users.
Understanding MFA enforcement methods
Microsoft 365 offers three main ways to require MFA. Choose the method that suits your organisation’s licensing and security requirements.
Security defaults
Security defaults are a free, baseline set of identity security settings available to all Microsoft 365 tenants. When enabled, security defaults require all users to register for MFA using the Microsoft Authenticator app and block legacy authentication. This is the simplest option for small businesses that do not need custom policies.
Per-user MFA
Per-user MFA lets administrators individually enable or disable MFA for specific user accounts in the Microsoft 365 admin centre. This method is useful for targeted rollouts but does not offer the same granular control as Conditional Access and can be more difficult to manage at scale.
Conditional Access
Conditional Access policies in Microsoft Entra ID let you require MFA based on conditions such as user location, device state, sign-in risk, or target application. Conditional Access requires appropriate Microsoft Entra ID licensing (such as Microsoft Entra ID P1 or P2). Review your licensing before creating Conditional Access policies.
Enable MFA for the organisation (administrator)
- Sign in to the Microsoft 365 admin centre at
https://admin.microsoft.comusing an account with Global Administrator or Authentication Administrator privileges. - In the left navigation, select Users, then choose Active users.
- On the Active users page, select Multi-factor authentication. This opens the legacy Azure AD multi-factor authentication portal.
- On the Users tab, select the user or users you want to enforce MFA for.
- In the right-hand pane, click Enable.
- Confirm the action. Selected users will be prompted to register their security information the next time they sign in.
Alternatively, you can manage MFA through the Microsoft Entra admin centre at https://entra.microsoft.com:
- Sign in with an administrator account.
- In the left menu, select Protection, then choose MFA.
- Configure per-user MFA settings or proceed to Conditional Access under Protection > Conditional Access to create policy-based enforcement.
Enable MFA for an individual user (self-service)
Users can register their own security information before an administrator enforces MFA. This reduces the risk of lockout.
- Sign in to your Microsoft 365 account at
https://myaccount.microsoft.com. - In the left navigation, select Security info. You can also go directly to
https://myaccount.microsoft.com/securityinfo. - Click Add sign-in method.
- Choose a verification method from the dropdown, such as Authenticator app, Phone, or Email, then click Add.
- Follow the prompts to complete registration. For the Microsoft Authenticator app, scan the QR code displayed on screen and enter the numeric code shown in the app to verify.
- Once registered, set your preferred default sign-in method from the Security info page.
Exclude emergency access accounts
Create at least two emergency access (break-glass) administrator accounts that are excluded from all MFA enforcement policies. These accounts should use strong, unique passwords stored securely and should only be used during an emergency, such as a lockout caused by a misconfigured Conditional Access policy. Do not assign these accounts to standard users for day-to-day work.
Troubleshooting
User locked out after admin-enforced MFA
If a user cannot sign in because MFA was enforced before they registered security information, an administrator can reset their MFA methods:
- Sign in to the Microsoft 365 admin centre at
https://admin.microsoft.com. - Go to Users > Active users.
- Select the affected user.
- In the user details pane, look for Multi-factor authentication or Manage security info.
- Choose Require re-registration or Reset MFA methods.
- Confirm the action. The user will be prompted to set up MFA again at their next sign-in.
Common issues
- Cannot find the Security info page – Make sure you are signed in with your work or school account, not a personal Microsoft account.
- Authenticator app will not scan the QR code – Clean your device camera, ensure the app has camera permissions, and try entering the setup key manually if scanning fails.
- SMS or voice call not received – Check that the phone number is entered correctly, including the Australian country code (+61), and confirm your mobile carrier is not blocking short-code messages.
- App passwords not working – App passwords are only for legacy applications that do not support modern authentication. They cannot be used to sign in to Microsoft 365 web portals.
- Conditional Access policy blocking sign-in – If you recently created a Conditional Access policy, sign in with an excluded emergency access administrator account to review or disable the policy.
When you need further assistance
If you have followed these steps and still experience problems, please Open a Ticket through our support portal. Include the affected user’s email address, the exact error message, and any screenshots showing where the process stops.
Still Having Issues?
💻 Open a Ticket