AZ.Innovations Decision guide
azinnovations.io

Microsoft 365 identity

Which Microsoft MFA should you use?

Microsoft has three ways to require multi-factor authentication, and the names do not make it obvious that they are alternatives. Here is how to choose in about sixty seconds.

The short answer

No premium license, use Security Defaults. Microsoft Entra ID P1 or P2, use Conditional Access. Either way, switch off legacy per-user MFA. It still works, but Microsoft no longer recommends it, and running it alongside the modern methods only creates duplicate enforcement.

The three methods at a glance

Feature 🗄Per-user MFA 🛡Security Defaults 🎛Conditional Access
What it is The original method: flip MFA on per account One free tenant-wide on or off switch Policies that require MFA based on conditions
Cost Free Free Entra ID P1 or P2 (in Business Premium, E3, E5)
Granularity Per user, prompts on nearly every sign-in All or nothing, everyone the same By user, app, location, device, and risk
Best for Almost no one in 2026 Small orgs with no premium license Anyone who needs exceptions or owns a license
Microsoft's stance No longer recommended Good baseline Recommended where licensed

Start here

01

Do you have Entra ID P1 or P2?

It is included with Microsoft 365 Business Premium, E3, and E5. If yes, use Conditional Access.

02

No premium license?

Turn on Security Defaults. One free switch, a safe baseline, nothing to configure.

03

Running per-user MFA?

Once the above handles MFA, set per-user MFA back to Disabled for everyone.

One thing that is not a choice. Separate from these three, Microsoft now enforces MFA on its own admin surfaces whether you configure anything or not. Since late 2024 the Azure, Entra, Intune, and Microsoft 365 admin centers require it, and a second phase that began October 1, 2025 extends this to the tools that manage Azure resources. Your admins need a working MFA method no matter which method you choose for everyone else.

Not sure what your tenant is actually enforcing?

Most environments we review run two MFA methods at once, leave admins half-covered, or pay for Conditional Access they never turned on. The Identity and Insurance Evidence Pack proves what your Entra ID enforces, in the format a cyber-insurance renewal asks for.

See the engagement →
© 2026 AZ Group Holdings LLC, doing business as AZ Innovations. Proprietary and confidential. Current as of June 2026 · Read the full guide