As of 13 August 2026, AI can only partly set up multi-factor authentication for Microsoft 365.

What to actually do

1. Hand it to a person

   The route this page recommends

   A person who owns the outcome does this end to end, worth it when the failure is dear.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 30 minutes until you can act on the result.

   How to actually do it

   1. Open the Microsoft Entra admin centre and record the tenant type, available admin role, licence or edition, existing security defaults and Conditional Access policies without pasting secrets into the chatbot.
   2. Gather the user groups, permitted authentication methods, emergency account arrangements, planned rollout window and any exclusions with their documented reasons.
   3. Paste those details into the prompt and ask the chatbot for a plan that separates confirmed Microsoft settings from assumptions and does not claim to have made changes.
   4. Compare the proposed route and settings against the options currently shown in your tenant, particularly the included users, exclusions, authentication methods, registration requirements and emergency access arrangements.
   5. Apply the policy to a small test group in the Microsoft Entra admin centre, then have a test user register an approved method and complete a Microsoft 365 sign-in from a normal device.
   6. Check the sign-in result, policy evaluation, registration status and emergency access before expanding the policy, and record who approved the change.
   7. Send the approved enrolment instructions to the remaining users, expand the policy in stages, and keep the documented recovery route available for failed registrations or lockouts.

   Prompt

   Act as a Microsoft 365 identity administrator helping me plan, not directly execute, a multi-factor authentication rollout. Use only the information I provide and do not ask for or handle passwords, MFA codes, access tokens or other secrets.
   
   Tenant and requirements:
   - Microsoft 365 licence or edition: [licence or edition]
   - Current identity setup, such as cloud-only or hybrid: [description]
   - Admin role available: [role]
   - Users or groups included: [groups]
   - Users or groups that must be excluded temporarily, with a documented reason: [exclusions]
   - Required authentication methods: [methods]
   - Existing Conditional Access policies or security defaults: [details]
   - Break-glass emergency accounts and their protection arrangements: [details]
   - Rollout constraints and planned maintenance window: [details]
   
   Give me a safe, ordered plan using the current Microsoft Entra admin centre terminology where you are certain of it. Separate confirmed steps from assumptions. Explain whether security defaults or Conditional Access is the appropriate route for this setup, identify conflicts with existing policies, and list the exact settings I must confirm before saving. Include a staged test plan, user communications checklist, rollback or recovery steps, and a post-change checklist. If a detail depends on the tenant or licence, say so instead of guessing. Do not recommend disabling MFA globally, sharing accounts, storing recovery codes insecurely or excluding users without a documented reason. Do not claim that you have changed anything.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.