Enable/Disable MFA for Single or All Users in Microsoft 365!

Protecting your Microsoft 365 accounts is critical, and multi-factor authentication (MFA) is your essential defense. MFA drastically reduces the risk of unauthorized access, even if your login details fall into the wrong hands. In this blog, we will walk you through turning MFA on or off for single users or all users within your Microsoft 365 tenant.

With the growing number of cyber threats, enabling Multi-Factor Authentication (MFA) has become a necessity rather than an option. Microsoft 365 offers robust tools for enforcing MFA across your organization, either at the individual level or tenant-wide. Understanding how to manage MFA properly ensures you’re safeguarding your data while maintaining user convenience.

This guide covers:

How to turn MFA on or off for a single user?
How to turn MFA on or off for all users?
Tips, best practices, and FAQ’s

Table of Content

Method 1: Enable / Disable MFA in Office 365 for a Single User

Step-by-Step via Microsoft 365 Admin Center:

Sign in to the Microsoft 365 Admin Center: https://admin.microsoft.com
Go to Users > Active users.
Click on the Multi-factor authentication link at the top (it may appear in the toolbar).
You’ll be redirected to the MFA management portal.
Search and select the user you want to configure.
On the right, you will see options to Enable or Disable MFA in Office 365.
Choose the appropriate action and confirm.

Tips: Enabling MFA will prompt users to configure additional verification methods on their next sign-in.

Method 2: Enable /Disable MFA for All Users

Option 1: Using the Admin Center

Follow steps 1-3 from the single-user method.
On the management portal, select multiple users by checking the boxes or selecting all users.
Choose Enable or Disable MFA from the right-hand panel.

Tips: This will enforce MFA for everyone, which may require user training and communication beforehand.

Option 2: Using Condition Access (Recommended for Enterprises)

Go to Azure Active Directory at https://aad.portal.azure.com.
Navigate to Security > Conditional Access > New Policy.
Name your policy (e.g., ‘Require MFA for All Users’).
Users or groups: Select All Users or a specific group.
Cloud apps: Select all or particular apps.
Grant: Select Require multi-factor authentication.
Click Create.

Tips: This method gives you more flexibility and control (e.g., exceptions, location-based policies).

The Final Verdict:

Securing your Microsoft 365 environment with MFA is essential in today’s threat landscape. Whether you choose to enforce MFA for a single user or the entire organization, Microsoft offers multiple tools to tailor its scalable and enterprise-friendly method. So, it is suggested to enable the MFA for an extra layer of security.

Frequently Asked Questions: –

Q. Is MFA available on all Microsoft 365 plans?

A. Yes, but advanced MFA management (like Conditional Access) is available with Azure AD Premium licenses.

Q. Will enabling MFA log users out?

A. No, but users will be required to set up MFA the next time they log in.

Q. Can I exclude some users from MFA and turn off MFA in Office 365?

A. Yes, you can define exclusions using Conditional Access. However, it is not recommended to turn off MFA in Office 365.

Q. Can MFA be enforced through PowerShell?

A. Yes, PowerShell can be used for bulk MFA configuration. It’s ideal for automation and scripting.

Q. What if a user loses access to their second factor?

A. Admins can reset MFA methods via the Microsoft 365 admin center under the user’s profile > Authentication methods.