Microsoft 365 Multi-Factor Authentication Setup Guide for Admins UK 2026

The reality: why MFA matters for M365 admins right now

If you're a Microsoft 365 administrator in the UK, you're a high-value target. Your admin credentials unlock email, OneDrive, SharePoint, Teams, and every user account in your organisation. A single compromised admin password has led to ransomware across NHS trusts, financial services firms, and mid-market companies in 2025 and into 2026.

Gartner research shows that 99% of breaches involve compromised credentials without multi-factor authentication (MFA) in place. That's not a scare tactic. That's the baseline threat landscape every UK IT leader now operates under.

The good news: setting up MFA on admin accounts takes less than an hour and removes that single point of failure. You're about to walk through the exact process used by secure organisations across the UK.

What you need before you start

Have these ready:

Global Administrator access to your Microsoft 365 tenant (yes, you'll need at least one account without MFA initially to set up the rest; we'll cover the bootstrap problem)

A secure method to register authenticator apps (Microsoft Authenticator is built-in and free; Google Authenticator and Authy work too)

A phone or device for testing

Access to your conditional access policies (if you're using Azure AD Premium, which is increasingly standard)

Time to test thoroughly before rolling out to all admins

If you're in healthcare (NHS, private practice, care sector), note that CQC guidance and NHS Digital security standards now expect MFA on all privileged accounts. Cyber Essentials Plus accreditation, which many UK suppliers now require, mandates MFA for administrative accounts.

Step 1: Enable MFA for your own admin account first

Log into the Microsoft 365 admin centre (admin.microsoft.com) with an admin account.

Go to: Users > Active users > [select your own account] > Multifactor authentication.

Click Enable next to your username. Microsoft will ask you to re-authenticate.

Choose your authentication method:

1. Microsoft Authenticator app (recommended): Download the free app on your phone, add your work account, and approve sign-ins with a tap. It's faster, more secure, and supports passwordless sign-in later.

2. Authenticator app (generic): Google Authenticator or Authy work, but they don't support Microsoft's advanced passwordless features.

3. Text message or phone call: Slower and less secure (SMS can be spoofed), but a backup option for users who don't have smartphones.

Set up at least two authentication methods. If your phone is lost, you'll need a second way to prove identity.

Pro tip: Use Microsoft Authenticator with "Approval" mode (tap yes/no on your phone) rather than time-based codes. It's harder to intercept.

Step 2: Set up Conditional Access policies (if you have Azure AD Premium)

Conditional Access is where MFA becomes smart. Instead of asking for MFA every single time (which creates admin frustration and password reuse), you enforce MFA only when the sign-in looks suspicious.

Navigate to: Azure AD > Security > Conditional Access > New policy.

Create a policy like this:

Name: "Require MFA for Admin Roles"

Assignments:

Users: Select "Directory roles"

Include: Global Administrator, Exchange Administrator, SharePoint Administrator, Teams Administrator (or whichever roles exist in your organisation)

Exclude: Break-glass emergency admin account (keep one password-only account for recovery)

Cloud apps or actions: "All cloud apps" or select Microsoft 365 apps specifically

Conditions:

Sign-in risk: High (optional but powerful; triggers MFA only on unusual sign-ins)

Device state: Exclude compliant devices (if you want to reduce MFA prompts for managed corporate devices)

Access controls:

Grant: "Require multi-factor authentication"

Session: Leave as default

Enable policy: On

This means: anyone signing in as a Global Admin will be prompted for MFA. But if they're on a known device in their usual location during working hours, they might not see the MFA prompt every single session (depending on your risk settings).

Reality check: Conditional Access requires Azure AD Premium licences (included in Microsoft 365 Business Premium and Enterprise plans). If you're on a basic M365 plan, you can still enforce MFA, but it will prompt every single time a user signs in (which is actually fine for admins; they sign in rarely).

Step 3: Roll out to other admins (carefully)

Before you enforce MFA across all admin accounts, communicate.

Send admins a step-by-step guide (Microsoft has templates at docs.microsoft.com). Give them a week to set up their own MFA before you enforce it.

Enforce it gradually:

Week 1: Send communication and guide

Week 2: Enable MFA manually for tier-2 admins (Exchange, SharePoint, Teams administrators)

Week 3: Enable MFA for tier-3 admins (User administrators, security admins)

Week 4: Enable MFA for service accounts and break-glass accounts (these are special; service accounts typically can't use MFA, so use app passwords instead)

Log into Users > Active users and bulk-select admins, then click the three dots and choose Enable multi-factor authentication.

Step 4: Handle the app passwords problem

Some legacy applications (older versions of Outlook, printers scanning to email, or old integrations) can't handle MFA prompts. They need an app password instead.

An app password is a unique, auto-generated 16-character password that bypasses MFA. It's less secure than MFA itself, but it's a necessary band-aid for legacy systems.

To create one:

Go to myaccount.microsoft.com > Security info > Add sign-in method > App password

Assign it to the legacy app

Delete it when the app is upgraded

Important: Only create app passwords when necessary. Don't hand them out like sweets. Document which accounts have them and why.

Step 5: Test, then test again

Actually try to sign in as each admin account. Try from a different device. Try from outside your office network. Confirm that MFA triggers and that your chosen authentication method works.

Try to sign in with an incorrect MFA response. Confirm that access is denied.

Document how long MFA takes from each method. Users will ask. The answer is usually "3 to 5 seconds with Authenticator, 10 to 30 seconds with SMS."

Test recovery. What happens if an admin loses their phone? (They should contact you to regenerate their authentication methods or use the break-glass account.)

The compliance angle: why this matters in the UK in 2026

CQC guidance for healthcare requires MFA on all privileged accounts. NHS Digital's Data Security and Protection Toolkit expects it. Cyber Essentials Plus (now a must-have for many UK government suppliers and healthcare procurement) mandates it. GDPR doesn't explicitly require MFA, but it's considered a reasonable security measure under Article 32.

If you're in healthcare and not yet enforcing MFA on admin accounts, this is now a governance gap. If you're elsewhere, it's still the single highest-ROI security control you can implement.

If setting up and managing MFA policies across your organisation feels like the start of a bigger security role, that's exactly the skillset IT admins are now expected to have. Microsoft 365 administration is evolving beyond user management into identity and access governance. If you want to build that expertise, the Microsoft 365 Administrator Course at SmoothOps 365 covers conditional access, MFA enforcement, and compliance requirements in depth. The course is currently on the waitlist (due to demand from NHS trusts and UK SMEs needing certified M365 admins), but you can join the notification list and get 20% off when enrolment opens again.

Frequently asked questions

Do I need to enable MFA for every user, or just admins?

Microsoft best practice is to enforce MFA on all users, but start with admins because they represent the highest risk. If your organisation has Azure AD Premium, you can use Conditional Access to enforce MFA based on risk (so risky sign-ins require MFA, but routine sign-ins from known locations might not). For most UK SMEs and healthcare organisations, rolling out MFA to all users within 3 to 6 months of enabling it for admins is standard practice by 2026.

What's the difference between MFA and passwordless sign-in?

MFA requires two factors (something you know, like a password, plus something you have, like a phone). Passwordless sign-in (like Microsoft Authenticator's "Approval" mode) removes the password entirely. You just tap "yes" on your phone, and you're signed in. Passwordless is more secure and faster, but it requires everyone to have a compatible device and to trust the approval process. Start with MFA; move to passwordless as your users adapt.

Can service accounts and automated integrations use MFA?

Service accounts and integrations typically cannot respond to MFA prompts. Instead, they use app passwords (a workaround) or, better, modern authentication methods like managed identities or service principals (if you're using Azure). Document every app password you create, who it's for, and why it exists. Replace them with modern auth as soon as the legacy system can support it.

What happens if an admin loses their phone and can't sign in?

This is why you have a break-glass account. It's a Global Admin account with no MFA, stored securely (password manager, printed in a sealed envelope in a safe), and accessed only for emergencies. An admin without MFA can sign in, re-register the affected admin's authentication methods, and restore access within minutes. Test this recovery process once a year.

Will MFA slow down sign-in times for admins?

Microsoft Authenticator approval takes 3 to 5 seconds. SMS codes take 30 to 60 seconds. For admins who sign in a few times a day, that's negligible. Conditional Access can reduce the number of MFA prompts by only triggering MFA on risky or unusual sign-ins, so admins signing in from their usual location during working hours might not see an MFA prompt at all after the first few days.