# Securing Microsoft 365 accounts in a small business

> When Microsoft requires MFA in Microsoft 365, what security defaults turn on, which plans add Conditional Access, and how to set up admin accounts for a team.

Microsoft requires **MFA in Microsoft 365** for administrators: since February 2025 for the Microsoft 365 admin center, and since October 2024 for the Azure, Entra, and Intune portals. For other users, MFA depends on your settings. Security defaults, free and often already on in tenants created since October 22, 2019, make every user register for MFA; Business Premium replaces them with Conditional Access.

**Key takeaways**

1. Microsoft began requiring MFA for sign-ins to the Microsoft 365 admin center in February 2025, and its documentation offers no way to opt out.
2. Since July 29, 2024, security defaults no longer give users a 14-day grace period to register for multifactor authentication.
3. Among the Microsoft 365 Business plans, only Business Premium includes Conditional Access (Microsoft Entra ID P1); security defaults and Conditional Access cannot be on at the same time.


## Is MFA required for Microsoft 365?

Yes for administrators, and up to you for everyone else. Microsoft's [mandatory MFA](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication) applies to anyone who signs in to its admin portals, while ordinary users get MFA through the settings you choose: security defaults or, on Business Premium, Conditional Access. This page is the Microsoft part of [securing your team's accounts](/guides/account-security/team-security/), and the menu paths below are those Microsoft published as of November 2026.

The case for turning it on for everyone is Microsoft's own: on its page about security defaults, it says MFA can block over 99.2% of identity-based attacks.

### What Microsoft already requires

- **Since October 2024:** MFA to sign in to the Azure portal, the Microsoft Entra admin center, and the Intune admin center.
- **Since February 2025:** MFA for the Microsoft 365 admin center, rolled out gradually.
- **Since October 1, 2025:** MFA for command-line and automation tools that change Azure resources.

Microsoft offers no exemption, and the rule covers emergency access accounts too. Staying signed in does not skip it.

### What security defaults turn on

[Security defaults](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults) are free, and Microsoft rolls them out to new tenants at creation. They:

1. make every user register for MFA, at first through Microsoft Authenticator notifications with number matching, then with codes from Authenticator or any standard authenticator app;
2. require MFA at every sign-in for 16 administrator roles, including Global, Billing, Exchange, SharePoint, User, and Security Administrator;
3. ask other users for MFA when Microsoft judges it necessary, depending on location, device, role, and task;
4. block legacy authentication, such as Office 2010 or basic IMAP, POP3, and SMTP sign-in;
5. block device code sign-in;
6. require MFA to manage Azure resources.

Since July 29, 2024, users get no 14-day grace period to register. Before turning them on, check for old devices that send email with a password only, such as some multifunction printers: they will stop working.

To check or change them: **Microsoft Entra admin center**, **Entra ID**, **Overview**, **Properties**, **Manage security defaults**, then **Enabled** and **Save**.

### Security defaults or Conditional Access

The two cannot be on at the same time. Microsoft advises keeping security defaults unless you switch to Conditional Access policies, and calls the older per-user MFA setting “not recommended.”

| Plan | Microsoft Entra ID | What you can use |
|---|---|---|
| Business Basic, Business Standard | Free | Security defaults |
| Business Premium | P1 | Conditional Access, which Microsoft recommends at this level |
| Microsoft 365 E3, E5 | P1, P2 | Conditional Access, which Microsoft recommends at this level |

For a team of two to 20 on Basic or Standard, security defaults are the whole answer. On Business Premium, Conditional Access lets you write your own sign-in rules instead.

### Administrator accounts

- **Few Global Administrators.** Microsoft recommends fewer than five and “as few as possible.” The person who bought the subscription is one automatically.
- **Separate accounts.** Keep administration on a dedicated account, not the one you use for email; an admin-only account needs no Microsoft 365 license.
- **Two emergency access accounts.** Microsoft's [guidance on emergency access](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access) asks for at least two cloud-only accounts, not tied to one person or to an employee's phone, ideally protected by a FIDO2 passkey, with credentials stored safely where several administrators can reach them, and tested regularly, for example every quarter.

One trap: an older Microsoft page for small businesses still says to exclude emergency accounts from MFA. The newer Entra documentation requires MFA for them, and that is the version to follow.

In a team of five, this could mean two people holding the Global Administrator role on separate admin accounts, plus the emergency accounts in a safe. That layout is our suggestion, not Microsoft's.

### Methods that resist phishing

Microsoft recommends phishing-resistant methods: Windows Hello for Business, Platform Credential for macOS, synced passkeys, FIDO2 security keys, passkeys in Microsoft Authenticator, and certificate-based authentication. Text messages, email codes, and authenticator app codes remain exposed to remote phishing. Passkeys are enabled under **Entra ID**, **Security**, **Authentication methods**, **Policies**. Start with administrators.

### The Google side

If part of your team works in Gmail and Google Drive, the equivalent settings have different names. See [the Google Workspace settings for a small team](/guides/account-security/team-security/google-workspace/).

### The info@ mailbox

Microsoft's answer to a shared address is a shared mailbox that nobody signs in to directly. Our page on [shared inboxes without shared passwords](/guides/account-security/team-security/shared-logins/) explains how it works.

### When an employee leaves

Microsoft publishes seven steps, and the order matters. See [closing a departing employee's access](/guides/account-security/team-security/offboarding/).