We want to enforce MFA on all Microsoft 365 accounts

In 2026 this is no longer optional, it is baseline. Microsoft itself is rolling it out step by step. Better to stay in control yourself.

Try this first

1. 1First check who currently has no MFA: Microsoft 365 admin > Active users > MFA Status column, or via Entra > Users > Authentication Methods per user.
2. 2Announce two weeks in advance to the whole team. Provide the instructions and pick a fixed enrollment day.
3. 3Turn on Security Defaults (Entra > Properties > Security defaults) if you do not have Conditional Access yet. That enforces MFA for all users.
4. 4For exceptions (POS, shared mailbox account, scanners): use service accounts with tight Conditional Access policies, or place those accounts under a separate CA exclusion. Do NOT use app passwords: Microsoft has disabled basic auth and since late 2024 you can no longer create new app passwords. Replace existing ones with OAuth flows before Microsoft fully disables them.
5. 5Plan a fallback slot for people who get stuck on enrollment day. Do not let anyone be locked out on a Tuesday morning.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.