MFA Security Issues

Did Microsoft Force MFA for All Users? Security Defaults Explained

Kushani Nimanthika Oct 22, 2026 869 views

Question details

The user is seeking clarification on a vendor announcement claiming Microsoft would make Multi-Factor Authentication (MFA) mandatory for all tenants on June 30, and how this impacts existing users.

Did Microsoft Force MFA for All Users on June 30?

Product: Microsoft 365
Device & OS: not provided
Scenario: Verifying third-party claims about mandatory tenant-wide MFA enforcement and determining if existing users will be disconnected or required to re-register.
Observed behavior: Confusion regarding exact MFA enforcement dates, Microsoft's security defaults, and the separate deprecation of Basic Authentication in Exchange Online.

Before you start

Before making changes to your tenant's authentication methods, log in to your Microsoft Entra admin center with global administrator privileges to review your current Conditional Access and Security Defaults settings.

Solution 1Recommended

Verify Microsoft Security Defaults and Authentication Policies

Determine whether the mandatory MFA announcement applies to your specific tenant and distinguish it from the Basic Authentication deprecation rollout.

Third-party vendor announcements often conflate Microsoft's incremental push for Security Defaults with the mandatory deprecation of Basic Authentication in Exchange Online, which fully began on October 1, 2022.

Microsoft does enforce MFA via Security Defaults on newer tenants automatically, but broad enforcement dates vary significantly based on tenant configurations, existing Conditional Access policies, and specific cloud services.

Check Official Microsoft Documentation

Visit the official Microsoft Entra release notes and documentation to review the latest rollout dates for Security Defaults and mandatory MFA enforcement for your specific region and tenant type.

Review Your Tenant's Security Defaults

Sign in to the Microsoft Entra admin center. Navigate to 'Identity' > 'Overview' > 'Properties' and check if 'Manage security defaults' is toggled on or off for your organization.

Audit Basic Authentication Status

Verify your Exchange Online settings in the Microsoft 365 Admin Center to ensure all users and applications have migrated to Modern Authentication, as Basic Authentication is permanently disabled.

Verify Microsoft Security Defaults and Authentication Policies

No Universal Disconnection: Existing users are generally given a 14-day grace period to register for MFA using the Microsoft Authenticator app once Security Defaults are enabled, rather than being abruptly disconnected from their sessions.

Free Microsoft Office alternative

Looking for a Hassle-Free Office Suite? Try WPS Office

While Microsoft 365 introduces complex tenant administration and mandatory authentication policies, WPS Office provides a straightforward, lightweight, and highly compatible alternative for users who just need powerful productivity tools without the enterprise IT overhead.

1. Download the Installer: Visit the official WPS Office website and click 'Free Download' to get the installer for your operating system.
2. Install WPS Office: Run the setup file and follow the straightforward on-screen instructions to complete the installation.
3. Start Creating: Open WPS Office and instantly start editing your Word documents, Excel spreadsheets, and PowerPoint presentations.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).No complex tenant or Azure AD MFA management required for standalone users.Lightweight design that requires minimal system resources.Free to use with a familiar, user-friendly interface.

microsoft office alternative - wps office

Frequently Asked Questions

What happens to existing Microsoft 365 users when MFA is enforced via Security Defaults?

When Microsoft enables Security Defaults on a tenant, existing users are prompted to register for Multi-Factor Authentication using the Microsoft Authenticator app upon their next sign-in. They typically receive a 14-day grace period to complete the setup before MFA becomes absolutely mandatory to access their accounts.

Is Basic Authentication still supported in Exchange Online?

No, Microsoft permanently disabled Basic Authentication for Exchange Online starting in October 2022. All users, email clients, and applications must now use Modern Authentication (OAuth 2.0) to connect.

Can I turn off MFA if it was automatically enabled by Microsoft?

If you have global administrative access, you can disable Security Defaults in the Microsoft Entra admin center under 'Properties'. However, Microsoft strongly recommends keeping MFA enabled to protect against identity attacks. Disabling Security Defaults usually implies you will manage security manually via Conditional Access policies.

Microsoft Office Security Issues