Cyber security for Irish small businesses

Microsoft 365

Two-step sign-in for every Microsoft 365 user: the admin screens, in order

Switching on two-step sign-in for a whole Microsoft 365 tenant is one setting. Doing it without stopping the office printer, and proving afterwards that every person is covered, takes three more screens.

By Oscar CobbeCurrent as at 5 minute read4 sources

Before you start

Microsoft offers three ways to require two-step sign-in. This guide covers the two a small business uses: security defaults, which come with every plan, and a Conditional Access policy, which needs Business Premium or another plan with Microsoft Entra ID P1. Our guide to two-step sign-in on Microsoft 365 and Google Workspace explains the choice between them, and what the DPC and insurers ask for.

You need the Conditional Access Administrator role, or Global Administrator, which Microsoft gives the person who created the tenant. The admin center is entra.microsoft.com.

Step 1: find what still signs in the old way

Security defaults block legacy authentication: older ways of signing in with only a username and password, used by some scanners, printers and old mail apps. Find them first, so switching on two-step sign-in does not stop them without warning.

  1. 1In the Microsoft Entra admin center, go to Entra ID, then Monitoring & health, then Sign-in logs.
  2. 2If the Client App column is missing, add it under Columns.
  3. 3Select Add filters, then Client App, choose every legacy authentication protocol, and select Apply.
  4. 4Do the same on the User sign-ins (non-interactive) tab, where devices that sign in by themselves appear.

What the results mean

Each entry names the account and the protocol it used. A printer or scanner that sends email is the usual one; the two-step article's section on legacy sign-in covers moving it to a method that still works.

Step 2: switch on security defaults

The switch itself is one page.

  1. 1In the Microsoft Entra admin center, go to Entra ID, then Overview, then Properties.
  2. 2Select Manage security defaults.
  3. 3Set Security defaults to Enabled, and select Save.

What happens next

From then on, Microsoft says, every user has to register for two-step sign-in, with no grace period since July 2024. Each person is asked at their next sign-in and sets up Microsoft Authenticator. Send staff the Authenticator guide before you switch it on.

Step 3: check that everyone has registered

A setting being on is not the same as every person being covered. The registration report shows the difference.

  1. 1In the Microsoft Entra admin center, go to Entra ID, then Authentication methods, then Activity.
  2. 2On the Registration tab, "Users capable of Azure multifactor authentication" counts the people who have registered a strong method and are allowed by policy to use it.
  3. 3Open the list of user registration details and filter it for anyone not capable. Each name there is an account a stolen password still opens.

Give the report time

Microsoft says the report updates for most users in the tenant in 36 hours, so check it again two days after the switch, and keep a dated copy of the list as your record.

On Business Premium: one Conditional Access policy

Conditional Access does the same job with rules you control, and it replaces security defaults: a tenant uses one or the other. Microsoft recommends every organisation start with one baseline policy that covers all users and all resources and requires two-step sign-in. Its steps:

  1. 1Go to Entra ID, then Conditional Access, then Policies, and select New policy.
  2. 2Under Users, include All users, and exclude your emergency access accounts (and, where you sync from an office server, the directory synchronisation accounts).
  3. 3Under Target resources, include All resources.
  4. 4Under Grant, select Grant access, then Require authentication strength, and choose the built-in Multifactor authentication strength.
  5. 5Set Enable policy to Report-only and select Create. Once the report-only results show nobody you need is blocked, switch it to On.

Emergency access accounts

Microsoft asks every tenant to keep emergency access accounts outside its policies, so a mistake in a policy cannot lock every administrator out.

Keeping it true

New staff register at their first sign-in, so the work is in the leavers and the lost phones. Disable a leaver's account on their last day. For a lost or replaced phone, our Authenticator guide for staff covers the admin steps. And run the registration report again whenever someone joins, so the list you keep stays a list of everyone.

Sources

  1. 1.Security defaults in Microsoft Entra ID · Microsoft Learn
  2. 2.Block legacy authentication with Conditional Access · Microsoft Learn
  3. 3.Authentication methods activity · Microsoft Learn
  4. 4.Require multifactor authentication for all users · Microsoft Learn

Switched on, and proven

Protect turns on two-step sign-in for every staff account and closes it with a dated document. It also covers SPF and DMARC, cookie consent, a privacy notice, a tested backup restore and a practised incident plan. From €2,950 up to 10 staff, fixed before we start.

Protect

Who wrote this

Oscar Cobbe · Founder, FourWinds Digital

Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.

More about how we work →

Read next

More on Cyber security for Irish small businesses

Written on 29 October 2026; it describes the law as FourWinds read it on that date. This is general information about how the rules work, not legal advice on your situation. Where you need a solicitor, we say so. How we check the law.