How to Set Up and Configure Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) adds an extra layer of security to user accounts by requiring two or more verification methods. This guide outlines how to set up and configure MFA for Microsoft 365.

Prerequisites:

• You must have global administrator permissions in Microsoft 365.
• MFA can be configured for individual users or for all users in your organization.

Step 1: Sign in to Microsoft 365 Admin Center

1. Open a web browser and go to admin.microsoft.com.
2. Sign in using your global administrator credentials.

Step 2: Access the Azure AD Portal

1. In the Microsoft 365 Admin Center, go to Admin centers in the left-hand panel.
2. Click on Azure Active Directory to open the Azure AD Admin Center.

Step 3: Configure MFA Settings

1. In the Azure AD Admin Center, select Security from the left-hand menu.

2. Under Protect and Govern, click on Multi-Factor Authentication.

   Alternatively, you can access the MFA settings directly via the Azure Portal:

   • Go to the MFA settings page and navigate to Security > MFA.

Step 4: Enable MFA for Users

There are two main options to enable MFA: per-user MFA or conditional access policies. Below are the steps for both methods:

Option 1: Enabling Per-User MFA (Simple Method)

1. On the Multi-Factor Authentication page, click on Users.

2. A list of your users will appear. To enable MFA for specific users:

   • Select the users you want to enable MFA for (you can select multiple users at once).
   • In the right-hand panel, click on Enable.

3. Confirm the action in the pop-up dialog by clicking Enable Multi-Factor Authentication.

   Once enabled, these users will be prompted to set up MFA the next time they sign in.

Option 2: Enabling MFA via Conditional Access (More Advanced)

Conditional Access allows you to apply MFA requirements based on certain conditions (e.g., location, device state).

1. In the Azure AD Admin Center, go to Security > Conditional Access.

2. Click on + New policy.

3. Under Assignments, select the users, groups, or roles that should be subject to MFA.

4. Under Access Controls, select Grant and then choose Require multi-factor authentication.

5. Save the policy and review the settings.

   Users who meet the conditions specified in your policy will be required to complete MFA.

Step 5: Configure MFA Methods

Once MFA is enabled for your users, you should configure the available authentication methods. Microsoft 365 supports several methods for MFA verification, including:

• Microsoft Authenticator App: A mobile app that generates one-time passcodes.
• Text Message (SMS): A one-time passcode sent via SMS.
• Voice Call: A one-time passcode sent via a phone call.
• Hardware Tokens: A physical token that generates a one-time passcode.
• FIDO2 Security Keys: Hardware keys used for authentication.

Steps to Configure MFA Methods:

1. In the Azure AD Admin Center, navigate to Security > Authentication methods.
2. Select the + Add method to choose the authentication options for your users.
3. Enable or disable methods based on your security requirements. The most commonly used method is the Authenticator App, but you can enable additional methods such as SMS or phone calls.
4. Save your changes.

Step 6: User Setup for MFA

After enabling MFA for users, they will need to set up their MFA method the next time they sign in.

1. When users sign in to Microsoft 365 (or Azure AD), they will be prompted to set up their MFA method.
2. The user will be asked to select their preferred method (e.g., Microsoft Authenticator, Text Message, Phone Call).
3. The user will complete the setup by following the on-screen instructions, which usually involve verifying their chosen method (e.g., entering a code sent via SMS or completing a push notification from the Authenticator app).

Step 7: Testing MFA

Once users have configured their MFA settings, you should test that MFA is working correctly.

1. Ask a user to log in to their Microsoft 365 account (e.g., via Outlook, Teams, or the portal).
2. The user should be prompted for their second form of authentication (e.g., an Authenticator app notification or a text message with a code).
3. Ensure the process works as expected, and verify that access is granted only after successful authentication.

Step 8: Monitor and Manage MFA Settings

After configuring MFA, you can monitor and manage MFA settings through the Azure AD Admin Center. Here's how:

1. In the Azure AD Admin Center, go to Security > Sign-ins.
2. You will see reports of sign-ins and whether MFA was used for each session.
3. Under Security > MFA settings, you can view user status to see which users have MFA enabled and configure additional settings.

Step 9: Review and Enforce MFA for All Users

• If MFA was only enabled for certain users, consider enforcing it for all users to improve security across your organization.
• You can configure Conditional Access policies to require MFA for all sign-ins, or use Per-User MFA to enable MFA for all users individually.

Important Notes:

• MFA significantly improves security, but it’s important to balance user convenience and security needs. Consider using app passwords for older apps that don’t support modern MFA methods.
• If users have trouble with MFA setup, ensure they have the latest version of the Microsoft Authenticator app and that their phone numbers or email addresses are correctly configured in their profiles.
• Regularly review your MFA settings and user activity to ensure ongoing protection.