Last verified October 16, 2026, against the Microsoft Learn pages linked below. The admin-center labels move. If a click path on this page does not match what you see, stop and use the Learn article rather than guessing.
If you look after a small business on Microsoft 365 and multifactor authentication is still optional, this is the hour I would spend first. Microsoft's security defaults documentation says, "Based on our learnings more than 99.9% of those common identity-related attacks are stopped by using multifactor authentication and blocking legacy authentication." The same page says the goal is a basic level of security "at no extra cost."
I wrote this for a tenant that does not already have Conditional Access. The about page is who publishes these notes.
What security defaults does
Security defaults is a Microsoft-managed set of protections. Turning it on, per that documentation:
- Requires all users to register for multifactor authentication.
- Requires administrators to do multifactor authentication every time they sign in, after they register. The page's list includes Global Administrator, Exchange Administrator, SharePoint Administrator, User Administrator, and Helpdesk Administrator, among others.
- Requires users to do multifactor authentication when Microsoft decides it is necessary, based on location, device, role, and task.
- Blocks legacy authentication. Microsoft's example of a client without modern authentication is Office 2010, and it names IMAP, SMTP, and POP3. Security defaults also blocks Exchange ActiveSync basic authentication.
- Blocks device code flow, the "type this code on another screen" sign-in used in phishing.
- Requires multifactor authentication for the Azure portal, the Microsoft Entra admin center, Azure PowerShell, and Azure CLI. Microsoft says this applies to Azure Resource Manager, and that this policy does not include Microsoft Entra ID or Microsoft Graph.
The same article has a second figure. In the note about removing the registration grace period, Microsoft's security defaults documentation says "MFA can block over 99.2% of identity-based attacks." That sentence is multifactor authentication alone. The 99.9% line is multifactor authentication plus blocking legacy authentication.
Microsoft's comparison table on the security defaults documentation lists the required licenses for security defaults as "None." Conditional Access on that same table requires "At least Microsoft Entra ID P1." The Entra licensing page says, "Entra ID P1 is also included in Microsoft 365 Business Premium for small to medium businesses." Read that page for the tenant you actually have.
Before you flip the switch
The outages I get called for are almost all legacy authentication. Give this part a day.
1. Check whether it is already on
Microsoft's security defaults documentation says tenants created on or after October 22, 2019 might already have security defaults, and that new tenants get it at creation. Protections wait through a 24-hour grace period. The same page says customers "are periodically notified for the automatic enablement of the security defaults" if they have no Conditional Access policies, no premium licenses, and are not actively using legacy authentication clients. Microsoft's Set up multifactor authentication for users article says, "Microsoft 365 tenants created after October 2019 have security defaults turned on by default." Check the switch before you schedule a project around it.
2. Turn off legacy per-user MFA
Microsoft's Set up multifactor authentication for users article says, "To use security defaults or Conditional Access, you need to turn off legacy per-user MFA for users in your organization." It also says, "If your organization's subscription was started after 2019, legacy per-user MFA is most likely not turned on."
To see the state, Microsoft's Enable per-user multifactor authentication article says to sign in as at least an Authentication Policy Administrator, browse to Identity > Users > All users, and click Per-user MFA. It calls Disabled "the default state for a user not enrolled in per-user Microsoft Entra multifactor authentication." It says, "Administrators may move users between states, including from Enforced to Enabled or Disabled." The click steps it prints are for Enable MFA. It does not print a Disable button. The Graph example on that page sets perUserMfaState to "disabled." The same article says, "If you use Conditional Access or security defaults, you don't review or enable user accounts using these steps." Do this before you rely on security defaults. After security defaults is on, the security defaults documentation says Disabled "is the appropriate status for users who are using security defaults or Conditional Access based multifactor authentication."
3. Find legacy authentication
This is what takes mail and the copiers down. Look for:
- Scan-to-email printers using basic SMTP authentication against Microsoft 365.
- Line-of-business apps or scripts that send or read mail over IMAP, POP, or SMTP.
- Very old Outlook. Office 2010 is Microsoft's example of a client without modern authentication.
- Anything that signs in with a code shown on a screen. Device code flow is blocked once security defaults is on. Microsoft also says that starting July 1, 2026, all new tenants block device code flow as part of security defaults.
Microsoft's article on blocking legacy authentication says to find that use in the sign-in logs:
- Sign in to the Microsoft Entra admin center as at least a Reports Reader.
- Browse to Entra ID, then Monitoring & health, then Sign-in logs.
- Add the Client App column if it is not shown (Columns, then Client App).
- Select Add filters, then Client App, choose the legacy authentication protocols, and select Apply.
- Do the same on the User sign-ins (non-interactive) tab.
Sign-in retention is seven days on Entra ID Free and 30 days on P1 and P2. A monthly script can be missing from a free tenant's logs, so ask whoever sends mail unattended.
Fix those clients before you enable the switch. Microsoft warns you to confirm administrators are off older protocols first. For copiers, use Microsoft's guide to mail from a multifunction device or application. That page says client SMTP submission using basic authentication is not compatible with security defaults, and it recommends modern authentication (OAuth). The options it describes are client SMTP submission, SMTP relay through a connector, direct send, and High Volume Email. It also says SMTP AUTH is disabled for organizations created after January 2020, and that you can enable it per mailbox. If a copier stops sending after you flip the switch, follow that Microsoft article or Microsoft's own support.
4. Create two emergency access accounts
Microsoft's security defaults documentation says to keep two cloud-only emergency access accounts permanently assigned the Global Administrator role. The emergency access article says to make them cloud-only accounts that use the *.onmicrosoft.com domain and that are not federated or synchronized. It says to choose "Passkey (FIDO2)" (recommended) or certificate-based authentication, because those methods "satisfy the mandatory multifactor authentication requirements." Store the keys apart from each other. The article says, "Don't connect these accounts with any employee-supplied devices, such as phones," and to use a FIDO2 security key for the emergency accounts if normal administrators use the Microsoft Authenticator app.
To register that passkey, Microsoft's Temporary Access Pass article describes "a time-limited passcode" that "can be configured for single use or multiple sign-ins," and says users "can sign in with a TAP to onboard other passwordless authentication methods," including a "FIDO2 security key." The emergency access article does not name Temporary Access Pass. The method that stays on the account is the passkey or the certificate. The pass expires.
The security defaults comparison table says customization is "No customization (on or off)." These accounts still have to satisfy multifactor authentication. The emergency access article says to exclude the accounts from Conditional Access policies that block or restrict sign-in. That exclusion is a Conditional Access step, for after you leave security defaults.
5. Separate admin accounts
Microsoft's tip on the security defaults page is separate accounts for administration and ordinary work, so administrators are not prompted for multifactor authentication all day. In a small business that means the owner's everyday mailbox is not Global Administrator. Create an admin account, put the role there, and take the role off the daily mailbox.
6. Tell people
Send this a few days ahead, on a day when someone can answer the phone:
On [date] we are turning on two-step sign-in for Microsoft 365. The next time you sign in, you will set up the Microsoft Authenticator app. It takes about five minutes. If you get stuck, call [the person who owns this change].
Point them at https://myprofile.microsoft.com and the Security info link. Microsoft says security defaults users register with the Microsoft Authenticator app using notifications. Codes from that app work later, but registration uses the notification option. A non-Microsoft OATH TOTP app can generate codes too. The prompt shows a number to type into Authenticator, which is Microsoft's control for MFA fatigue.
Starting July 29, 2024, Microsoft removed the 14-day registration grace period for new and existing tenants. People register at the next prompted sign-in. The mail above is what keeps that from landing as a surprise at 8:15.
Enabling it
Microsoft's security defaults documentation says you must be assigned at least the Conditional Access Administrator role. Microsoft's Set up multifactor authentication for users article names a different pair for turning security defaults on or off: Global Administrator or Security Administrator. The steps on the security defaults page:
- Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
- Browse to Entra ID, then Overview, then Properties.
- Select Manage security defaults.
- Set Security defaults to Enabled.
- Select Save.
Make existing sessions register
Microsoft's security defaults documentation says administrators should revoke existing tokens so previously authenticated users have to sign in and register. The cmdlet is Revoke-MgUserSignInSession. Its reference lists User.RevokeSessions.All as the least-privileged delegated permission, and it says a user principal name can be used as -UserId. The example below is that cmdlet plus a connect step scoped to the smaller permission.
Import-Module Microsoft.Graph.Users.Actions
Connect-MgGraph -Scopes "User.RevokeSessions.All"
Revoke-MgUserSignInSession -UserId "user@contoso.com"
On a small tenant I do this while the person is at their desk, a few users at a time. Revoking everyone at 9:00 produces a single pile of "Outlook wants my password" calls.
Microsoft also says all administrators should sign in right after you enable security defaults so they can register.
After it is on
That day I sign in as a test user in a private browser window and confirm the registration prompt, confirm each admin account has registered, and send a test scan from every copier.
That week I read sign-in failures, especially anything still attempting legacy authentication. On a free tenant you only have seven days of logs, so I do not wait a month. I also chase anyone who has not registered.
"Disabled" on the old per-user MFA page is the status Microsoft says to leave alone. The security defaults article says Disabled is the appropriate status for users covered by security defaults or Conditional Access.
Leave the authentication methods enabled. Microsoft warns that disabling methods while security defaults is on can lock you out of the tenant.
Microsoft also notes that Exchange Online tenants created before 2017 have modern authentication disabled by default, and that you enable it to avoid a login loop. If you hit that loop, use the security defaults article and Microsoft's own support. I am not publishing a fix for it here.
The same article says the Microsoft Entra Connect / Cloud Sync synchronization account, and any principal in the Directory Synchronization Accounts role, is excluded from security defaults. Do not use that account for ordinary admin work.
When security defaults is the wrong tool
Classic security defaults is on or off. Microsoft's security defaults documentation table says "No customization (on or off)." I move a tenant to Conditional Access when a specific account or location needs an exception, or when access should require a managed or compliant device, or when the tenant already has Entra ID P1 or P2. The Entra licensing page says, "Entra ID P1 is also included in Microsoft 365 Business Premium for small to medium businesses."
When you disable security defaults, turn the replacement policies on in the same sitting. Microsoft's managed policies are the gap-filler: multifactor authentication for admins, for users, and for Azure management, plus blocking legacy authentication.
The short version
- Find legacy authentication in the sign-in logs (seven days of history on a free tenant, per Microsoft's data retention article) and fix the copiers and scripts first, using Microsoft's multifunction-device guide.
- Turn off legacy per-user MFA. Microsoft's admin article says you need it off before you use security defaults. If the subscription started after 2019, that article says it is most likely not on.
- Create two cloud-only emergency-access Global Administrators with a passkey (FIDO2) or certificate-based authentication, and take Global Administrator off the everyday mailbox.
- Warn people and point them at myprofile.microsoft.com, which is where Microsoft's security defaults page sends them to register.
- In the Entra admin center, open Entra ID, Overview, Properties, Manage security defaults, set it to Enabled, and save.
- Revoke sessions a few users at a time, confirm the administrators registered, test the copiers, and read the sign-in logs that week.
If a sign-in fails and the Learn pages above do not cover it, contact Microsoft. This page is the enablement order I use.
If you want this checked with the rest of the office
Multifactor authentication on mail is one of the first items in the Small Business IT Checkup. That page says, "The Small Business IT Checkup is $199." The longer checklist that this step sits inside is the small business IT checklist.
What the $199 checkup covers is on the site FAQ.
Works Cited
"About." ITOps Desk, itopsdesk.org/about. Accessed 16 Oct. 2026.
"FAQ." ITOps Desk, itopsdesk.org/faq. Accessed 16 Oct. 2026.
Microsoft. "Block legacy authentication with Conditional Access." Microsoft Learn, 24 Mar. 2026, learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-legacy-authentication. Accessed 16 Oct. 2026.
Microsoft. "Configure a Temporary Access Pass in Microsoft Entra ID to register passwordless authentication methods." Microsoft Learn, 4 Mar. 2026, learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass. Accessed 16 Oct. 2026.
Microsoft. "Configure Security Defaults for Microsoft Entra ID." Microsoft Learn, 16 Oct. 2026, learn.microsoft.com/en-us/entra/fundamentals/security-defaults. Accessed 16 Oct. 2026.
Microsoft. "Enable per-user multifactor authentication." Microsoft Learn, 13 July 2025, learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-userstates. Accessed 16 Oct. 2026.
Microsoft. "How to set up a multifunction device or application to send email using Microsoft 365 or Office 365." Microsoft Learn, 16 Sept. 2026, learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365. Accessed 16 Oct. 2026.
Microsoft. "Manage emergency access admin accounts." Microsoft Learn, 5 June 2026, learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access. Accessed 16 Oct. 2026.
Microsoft. "Microsoft Entra data retention." Microsoft Learn, 25 Mar. 2026, learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-reports-data-retention. Accessed 16 Oct. 2026.
Microsoft. "Microsoft Entra licensing." Microsoft Learn, 18 June 2026, learn.microsoft.com/en-us/entra/fundamentals/licensing. Accessed 16 Oct. 2026.
Microsoft. "Revoke-MgUserSignInSession (Microsoft.Graph.Users.Actions)." Microsoft Learn, learn.microsoft.com/en-us/powershell/module/microsoft.graph.users.actions/revoke-mgusersigninsession?view=graph-powershell-1.0. Accessed 16 Oct. 2026.
Microsoft. "Set up multifactor authentication for users." Microsoft Learn, 11 Dec. 2025, learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide. Accessed 16 Oct. 2026.
"Small Business IT Checkup." ITOps Desk, itopsdesk.org/small-business-it-checkup. Accessed 16 Oct. 2026.