Summary: Learn how to set up multi-factor authentication (MFA) for Office 365 users.
Notes:
-
Azure multi-factor authentication is a method of verifying who you are that requires the use of more than just a username and password. Using MFA for Office 365, users are required to acknowledge a phone call, text message, or app notification on their smart phones after correctly entering their passwords. They can sign in only after this second authentication factor has been satisfied.
-
A form of multi-factor authentication is included with Office 365, but you can also purchase Azure multi-factor authentication that includes extended functionality. For more information, see feature comparison of Azure multi-factor authentication versions.
Set up multi-factor authentication in the O365AdminCenter
-
Sign in to Office 365 with your work or school account.
-
Go to the Office 365 admin center.
-
Navigate to Users > Active users.
-
In the Office 365 admin center, click More > Setup azure multi-factor auth.
-
Find the user or users who you want to enable for MFA. In order to see all the users, you might need to change the Multi-Factor Auth status view at the top.
The views have the following values based on the MFA state of the users:
-
Any Displays all users. This is the default state
-
Enabled The user has been enrolled in multi-factor authentication, but has not completed the registration process. They will be prompted to complete the process the next time they sign in.
-
Enforced The user may or may not have completed registration. If they have completed the registration process then they are using multi-factor authentication. Otherwise, the user will be prompted to complete the process at next sign-in.
-
-
Check the check box next to the users you want to enable.
-
On the right user info pane, under quick steps you'll see Enable and Manage user settings. Choose Enable.
-
In the dialog box that opens, click enable multi-factor auth.
Allow MFA users to create App Passwords for Office client applications
Important: App passwords are not supported for Office 365 operated by 21Vianet.
Multi-factor authentication is enabled per user. This means that if a user is enabled for multi-factor authentication and they are attempting to use non-browser clients, such as Outlook 2013 with Office 365, they will be unable to do so. An app password allows this to occur. An app password, is a password that is created within the Azure portal that allows the user to bypass the multi-factor authentication and continue to use their application.
Important: All the Office 2016 client applications support multi-factor authentication through the use of the Active Directory Authentication Library (ADAL). This means that app passwords are not required for Office 2016 clients.
-
Go to the Office 365 admin center.
-
Navigate to Users > Active users. Your screen should look like one of the following:
-
In the Office 365 admin center, click More > Setup azure multi-factor auth.
-
In the multi-factor authentication page, choose service settings.
-
Under app passwords, choose Allow users to create app passwords to sign into non-browser applications.
This allows users to use client Office applications, but they will have to enter a password of their choosing first.
-
Click Save, and then Close.
Manage MFA user settings
-
In the multi-factor authentication page, check the box next to the user or users you want to manage.
-
In the user info pane on the right, you'll see two options: Enable and Manage user settings. Choose Manage User settings.
-
In the Manage user settings dialog, check one or more of the options: Require selected users to provide contact methods again, Delete all existing app passwords generated by the selected users, or Restore Multi-Factor Authentication on all remembered devices.
-
Click Save.
Bulk-update users in MFA
You can bulk update the status for existing users using a CSV file. The CSV file will be used only for enabling or disabling multi-factor authentication based on the user names present in the file. It is not used to create new users.
-
In the multi-factor authentication page, click bulk update.
-
Browse for the file that contains the updates. The column headings in your file must match the column headings in the following example:
Instructions for your users once MFA is set up
After you have enabled MFA on your tenant, your users can follow these instructions to set up their second sign-in method for Office 365:
|
|
New to Office 365?
