MFA for nonprofits: turn on multi-factor sign-in in Microsoft 365

Microsoft describes multifactor authentication, also called MFA, two-factor authentication or 2FA, as requiring a second verification method for user sign-ins, which improves account security. In practice the second step is usually an approval or code from the Microsoft Authenticator app on a phone.

Microsoft says Authenticator is a free app that can verify a sign-in with a fingerprint, face recognition or a PIN, so staff do not have to type a code every time.

• Security defaults. Microsoft makes these preconfigured settings available to every organization at no extra cost, through Microsoft Entra ID Free. This is the simplest start for a small nonprofit.
• Conditional Access policies. These need Microsoft Entra ID P1 or P2, which come with some Microsoft 365 plans such as Business Premium, and give finer control over who is asked for MFA and when. Microsoft says that if your organization has P1 or P2 licenses, security defaults are probably not right for you.
• Legacy per-user MFA. Microsoft lists it as an option but says it is not recommended.
• Security defaults and Conditional Access cannot be turned on at the same time. Microsoft says not to turn security defaults off unless you are switching to Conditional Access policies.

Microsoft says tenants created on or after October 22, 2019 might already have security defaults on, and that they are rolled out to new tenants at creation. To check yours, sign in to the Microsoft Entra admin center, open Overview, then Properties, then Manage security defaults.

• All users must register for multifactor authentication.
• Administrators must do multifactor authentication.
• Other users are asked for multifactor authentication when necessary. Microsoft decides when, based on things like location, device, role and task.
• Legacy authentication protocols are blocked, and so is device code flow.
• Privileged activities such as access to the Azure portal are protected.
• When someone is prompted, Microsoft says they see a number to enter in the Microsoft Authenticator app, which Microsoft says helps prevent MFA fatigue attacks.

• Tell staff and volunteers what is coming, on what day, and who to ask for help.
• Give every person their own sign-in. Shared logins cannot be protected one person at a time.
• List the older apps, scanners, copiers and mail programs that send or read email. Security defaults block legacy authentication, so anything that relies on it may stop working. Ask each maker what it supports.
• Have everyone install the Microsoft Authenticator app on their phone. Admins should sign in right after the change so they can register their methods.
• Microsoft recommends separate accounts for administration and for everyday work, which also means fewer MFA prompts for admins.
• Create an emergency access account, as Microsoft describes, and store its details safely so one lost phone cannot lock the organization out.
• Decide who an admin will help when a phone is lost or replaced, and write down how.

Microsoft is enforcing MFA for accounts that sign in to the Azure portal, the Microsoft Entra admin center and the Microsoft Intune admin center, and it began a gradual rollout of the same requirement for the Microsoft 365 admin center in February 2025. If your administrators already use MFA, or sign in with stronger methods such as passkeys, nothing changes for them. Turning on MFA for every user is still your decision.

• Ask one staff member to sign in first and tell you what they saw, then roll out to everyone.
• Check that each person has registered a method, and follow up with the ones who have not.
• Check that the emergency access account works, and put a reminder on the calendar to check it again.
• Repeat the check when you add a new staff member, volunteer or board member with an account.

TRUE.org Cloud is a 501(c)(3) nonprofit. We can look at how your tenant signs people in today, tell you whether security defaults are on, and help you plan the rollout so staff are not surprised. That help is free for registered nonprofits, charities and faith-based organizations in the United States and Canada, and this page has no prices on it.

If you choose to buy licenses through TRUE.org, they are provided by TRUE.org's for-profit Microsoft Cloud Solution Provider, not by the nonprofit. You can always buy direct from Microsoft or from another partner instead.