For most Microsoft 365 organizations, enable Security defaults in Microsoft Entra ID. Choose Conditional Access instead if your tenant has the required license and needs tailored rules or exclusions. Treat per-user MFA as a legacy fallback, not the first choice. Before changing settings, confirm the tenant’s license, administrator role, and the apps and devices your users rely on.
Choose the MFA method that fits your tenant
Office 365 identity settings are managed in Microsoft Entra ID. Microsoft uses “multifactor authentication” (MFA) and “two-factor authentication” (2FA) for the same general idea: users must provide more than one form of verification. The right way to require it depends on your licensing and how much control you need.
| Option | License and control | Best fit |
|---|---|---|
| Security defaults | Available through Entra ID Free; fixed baseline with limited customization. | Organizations that want a straightforward baseline without Conditional Access requirements. |
| Conditional Access | Requires at least Entra ID P1; supports tailored conditions, exclusions, and authentication strengths. Risk-based Conditional Access is associated with P2. | Organizations that need policies tailored to users, apps, sign-in conditions, or authentication strength. |
| Per-user MFA | Account-by-account legacy configuration. | A fallback when neither recommended approach is suitable; Microsoft recommends Security defaults or Conditional Access instead. |
Microsoft lists Microsoft 365 Business Premium and E3 with Entra ID P1, and Microsoft 365 E5 with P2, but plan names alone are not enough to establish what a particular tenant can use. Verify its actual SKU and entitlements against Microsoft Entra licensing. Microsoft’s method availability comparison also varies by plan: Security defaults with Entra ID Free uses a mobile authenticator app, while Office 365 and P1/P2 plans enable further capabilities, including text or phone methods and administrator control of verification methods. Check the current licensing documentation and tenant configuration before promising users a particular method.
Security defaults and Conditional Access cannot both be enabled at once. If you move from defaults to Conditional Access, plan the replacement policies first and preserve equivalent protections. Microsoft says to enable Conditional Access policies immediately after disabling defaults.
Recommended Free Tools
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Enable Security defaults
- Sign in to the Microsoft Entra admin center with an authorized administrator account. Microsoft’s Microsoft 365 setup guidance lists Global Administrator or Security Administrator for changing defaults; its Security defaults guidance names Conditional Access Administrator as the minimum. Because those role requirements differ across Microsoft’s guidance, check the current role requirement in your tenant. Use the least-privileged role that can perform the change and reserve Global Administrator for tasks that cannot be done with a lower-privileged role.
- Open the settings: go to Entra ID > Overview > Properties, then select Manage security defaults.
- Check the current setting. Microsoft says Microsoft 365 tenants created after October 2019 have Security defaults enabled by default. If they are off, set Security defaults to Enabled and save.
- Prepare users to register. Under Security defaults, users must register using Microsoft Authenticator notifications. They may use OATH TOTP codes to authenticate. Tell users what to expect and do not disable authentication methods while defaults are in use; Microsoft warns that doing so can lock users out.
- Check older sign-in dependencies. Identify applications and devices relying on older authentication behavior before rollout. Microsoft warns administrators to ensure they are not using older protocols before enabling defaults. Device-code-flow sign-ins are blocked when defaults are enabled; Microsoft also says all new Entra tenants block device code flow as part of defaults starting July 1, 2026.
Security defaults also apply to B2B guest and direct-connect users accessing the directory. Consider those users in communications and access planning.
Use Conditional Access for a tailored all-users policy
Conditional Access is for organizations with Entra ID P1 or higher. It offers more flexibility than Security defaults, but a misconfigured policy can disrupt access. Microsoft recommends building a baseline policy for all users and resources that requires MFA, then testing it before enforcement.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
- Plan the transition. If Security defaults are on, prepare the replacement Conditional Access policies before turning defaults off. Microsoft says the two options cannot be enabled together and advises enabling Conditional Access policies immediately after disabling defaults.
- Open the policy area: in the Microsoft Entra admin center, go to Entra ID > Conditional Access > Policies and create a policy.
- Set the scope: target All users and All resources for the baseline policy. Exclude emergency-access or break-glass accounts, and account for directory synchronization accounts and guest-specific policy design where relevant. Do not omit emergency-access planning.
- Require MFA: under Grant, require the built-in Multifactor authentication strength. Microsoft’s guide describes three built-in strengths: standard MFA, passwordless MFA, and phishing-resistant MFA.
- Test before enforcement: set the policy to Report-only, review its impact, and resolve unintended effects. Switch it to On only after validating the scope and expected behavior.
Microsoft attributes the statement “Your password doesn’t matter, but MFA does!” to Alex Weinert, Director of Identity Security at Microsoft. The accompanying claim says an account is “more than 99.9% less likely to be compromised if you use MFA,” based on Microsoft’s studies; the reviewed page does not state the year or describe the study design. Treat it as Microsoft’s attributed finding, not a universal guarantee.
Use per-user MFA only as a fallback
Microsoft strongly recommends Security defaults or Conditional Access instead of per-user MFA. Do not enable or enforce per-user MFA if Conditional Access policies are in use.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- In the Entra admin center, go to Identity > Users > All users > Per-user MFA.
- Select the accounts to change, choose Enable MFA, and confirm.
- Tell users who have no registered method that they will be prompted to register at their next sign-in.
An account set to Enabled can still use password-only legacy authentication until its user registers. After registration, Microsoft automatically moves the account to Enforced. Forcing Enforced before registration can interrupt legacy connections.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify the rollout without misreading the status page
- Do not rely on the legacy per-user status alone. Users protected by Security defaults or Conditional Access may show as Disabled in the old per-user MFA view. That status does not, by itself, mean MFA protection is absent.
- Check registration and user readiness. Communicate the registration step and the authentication method users should expect under the selected approach.
- Review affected apps, devices, and exceptions. Validate older protocols, device-code dependencies, emergency-access exclusions, guest policy design, and the actual users and resources reached by Conditional Access.
- Confirm licensing and methods in the tenant. Entitlements and available verification methods vary by plan and configuration; check the actual SKU and current Microsoft licensing guidance.
For Microsoft’s detailed procedures and caveats, see its Microsoft 365 MFA setup guide, Security defaults documentation, all-users Conditional Access MFA guide, authentication methods and licensing comparison, and per-user MFA user-state guidance.
Quick Recap
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
