Setting up MFA for Microsoft 365 and Entra ID (2026)

The email arrives from someone in IT you have never met: all users must enroll in multifactor authentication over the coming weeks. Below it, a link, a deadline, and a help-desk number. That is how most of the working world meets Microsoft 365 MFA — as a decree, not a decision.

It is worth ten minutes to understand. The account being locked down is the operating system of modern work — mail, calendar, files, chat, and, through password-reset links aimed at the inbox, the spare key to half the other services in your life. A personal account carries its own weight: Outlook.com, OneDrive, an Xbox library, a payment method. The anatomy of the factors is our primer's territory; this post is the Microsoft-specific map.

What Microsoft calls it this year

The official term is multifactor authentication — MFA — used with bureaucratic consistency across Microsoft's documentation. The friendlier two-step verification is what consumer screens say and what people say out loud, so Microsoft 365 2FA and Entra ID MFA are the same question in different clothes.

Then there is the renaming: the directory behind it all was Azure Active Directory until 2023, when Microsoft rebadged it Microsoft Entra ID. Nothing about the feature changed — Azure AD MFA and Entra ID MFA are the same system — but a remarkable amount of material on Azure AD MFA methods still searches better under the dead name. Office 365 became Microsoft 365 in the other direction, yet O365 2FA survives as a search term anyway. All of these names point at the same door.

The methods Entra ID offers

Microsoft's authentication methods overview is the authoritative list; here is the practical version.

Push, with number matching. The default wherever push is allowed: your phone buzzes, the laptop shows a two-digit number, you type it into the app, then confirm with biometric or PIN. Number matching became mandatory in 2023 and, as of this writing, cannot be switched off. The reason is push-bombing: an attacker with your password sends prompt after prompt at 2 a.m., hoping someone taps Approve to make it stop (how number matching works).

TOTP in any authenticator app. Underneath the branding, the authenticator-app method is standard TOTP — a shared secret plus the current time, the scheme our primer covers. The enrollment QR encodes an otpauth:// URI with a Base32 secret; any RFC 6238-compliant app can hold it. Microsoft's app is an option, not a requirement.

Passkeys and FIDO2 security keys. The phishing-resistant tier: a passkey in an app, or a hardware key over USB or NFC, signs you in with cryptography bound to the real sign-in origin, which a lookalike page cannot use. Whether passkeys are on the menu is an administrator decision.

Windows Hello for Business. The same idea on a managed Windows device: the credential is bound to the machine, so unlocking the laptop becomes the second factor. Excellent when it applies to you; not your call when it does not.

SMS and voice. The legacy tier: codes travel a channel your carrier can be socially engineered into redirecting — the SIM-swap problem — and Microsoft has been phasing SMS and voice out of default configurations. Retirement dates keep moving, so treat "SMS is on the way out" as a direction, not a deadline.

The three enforcement layers

If you administer nothing, this section tells you which world you live in: the Tuesday email came from one of three mechanisms, and they are not interchangeable.

Security defaults are the free baseline, on for every new tenant: everyone is prompted to register and challenged at sign-in, legacy authentication is blocked, admins get it first and hardest. The trade is all-or-nothing — no per-app rules, no exceptions — which is its charm for an organization with no security staff (security defaults documentation).

Per-user MFA is the legacy toggle that let an admin mark individual users as "MFA required" before policy engines existed. It still works, plenty of small organizations still run it, and Microsoft's documentation steers admins firmly toward the other two.

Conditional Access is the real engine: if-then policies that demand MFA per application, network location, device state, or calculated sign-in risk. It requires licensing that includes Entra ID P1 — bundled into most mid-size-and-up subscriptions — and stands behind nearly every corporate MFA mandate (Conditional Access overview).

So: a personal account has none of these layers — you get your own two-step toggle. A small organization without IT probably runs security defaults. Anything with a help desk is almost certainly Conditional Access.

Microsoft is making MFA non-optional

Since 2024, Microsoft has been phasing in mandatory MFA: the admin center first, then broader sign-in surfaces, aiming at MFA for essentially everyone. The dates have shifted more than once, so treat any calendar, this one included, as approximate; the direction has never moved. Tenants that spent a decade deciding whether to require MFA are being relieved of the decision — if one of them is yours, Microsoft's admin-center setup documentation is the starting point.

Setting it up on your own account

Personal account or work account you manage yourself, the door is the same: the Security info page — aka.ms/mfasetup, mysignins.microsoft.com/security-info, or account.microsoft.com/security all land there. From there:

1. Sign in and open Security info, then Add sign-in method.
2. Pick the method: Authenticator app covers push (in Microsoft's app) and plain TOTP (in any app); a passkey or security key covers the phishing-resistant tier.
3. For TOTP outside Microsoft's app, follow the enrollment screen's link for using a different authenticator app: it produces a plain QR any compliant app can scan, or the same secret as Base32 text via manual entry.
4. Scan, type back the six-digit code the app shows, and confirm.
5. Before closing the tab, add a second method.

Step five is the one everyone skips, and it is the difference between a bad afternoon and a lost week.

A sanity check before you commit: the guest generator at 2FA by DependsiT takes a Base32 secret, an otpauth:// link, or an image of Microsoft's QR code and shows working codes in the page — computed locally, nothing sent, nothing stored. A cheap way to confirm the seed generates before choosing where it lives.

Recovery: the way back in

The classic lockout story is always the same shape. New phone. The old one was traded in, factory reset, or dropped in a lake — before its authenticator entry was removed. No second method was ever registered. The password works; the only thing that can complete a sign-in is at the bottom of a lake.

For a work or school account, the fix is administrative: an admin can clear your old methods or require re-registration; the next sign-in walks you through enrolling the new device. For a personal account with nothing else registered, the road is account recovery — identity verification, last-known passwords, a multi-day wait, no guarantee.

The prevention is boring and total: register two methods that cannot die together. An authenticator entry on the phone plus an alternate email. A passkey plus a printed recovery code — personal accounts can generate one under Advanced security options, precisely for the lake. Two methods, two places, one habit.

Why TOTP in a third-party app beats push-only

Push is pleasant and Microsoft-shaped: only Microsoft accounts, only Microsoft's app, and only when the network cooperates. A TOTP seed is just data — any RFC 6238 app, any device, offline, the same open standard that guards a Google account or a crypto exchange — and when you change phones or apps, the seed moves with you. Push also carries its own attack surface: fatigue attacks and real-time relay are live techniques; number matching blunts one, not the other — our bypass guide covers the mechanics. None of this makes Microsoft Authenticator a bad choice; the full guide has the detail. The point is smaller: push locks your second factor into one vendor's app for one vendor's accounts; TOTP keeps it portable.

Microsoft has spent the last few years renaming every piece of this system and making the feature impossible to skip. The choice that remains yours is the method, and where its secret lives — and if you want to see the machinery first, open the guest generator, paste the enrollment secret, and watch the codes arrive.

Frequently asked questions

Is Microsoft 365 MFA the same as Office 365 2FA?

Yes. Office 365 was renamed Microsoft 365, and its directory, Azure Active Directory, was renamed Microsoft Entra ID in 2023. The MFA feature never changed — same admin center, same methods, same enforcement — so Office 365 2FA setup, O365 2FA, Azure AD MFA, and Entra ID MFA are searches for the same configuration.

Do I have to use the Microsoft Authenticator app?

No. The authenticator-app method is standard TOTP, so any RFC 6238-compliant app holds the enrollment by scanning the QR code shown during setup. You give up push approval and passwordless sign-in, which are exclusive to Microsoft's app; you gain portability, since the seed works in any compliant app on any device.

Can number matching be turned off for push notifications?

Not anymore. Number matching became required for push in 2023, and as of this writing no setting restores the old tap-Approve flow. It exists to defeat push-bombing: an attacker with your password floods your phone with prompts, hoping for a reflexive approval. If you cannot live with it, the alternative is a different method, not a switch.

What is the difference between security defaults and Conditional Access?

Security defaults are the free, all-or-nothing baseline: every user is prompted, legacy authentication is blocked, no per-app nuance. Conditional Access is the licensed engine — it needs a subscription including Entra ID P1 — that demands MFA for specific apps, networks, device states, or risk levels. Small organizations typically run defaults; anything with a help desk almost always runs Conditional Access.

What happens if I lose my phone and have no other method?

For a work or school account, an admin can clear your old methods or require re-registration, and the next sign-in becomes a fresh enrollment. For a personal account, the next stop is account recovery: identity verification, known-password questions, a multi-day wait, no guaranteed outcome. The difference is preparation — an alternate email, a second method, or a saved recovery code turns the worst case into a five-minute fix.