In Microsoft 365, turn on security defaults in the Microsoft Entra admin center. In Google Workspace, allow and then enforce 2-Step Verification in the Admin console. Give staff a week's notice and help them set up an authenticator app.
Why it matters now
Since April 2026, Cyber Essentials fails any application where a cloud service offers two-step verification (also called multi-factor authentication or MFA) and it isn't switched on for every user. Stolen passwords are behind most account takeovers, and a second step stops almost all of them.
Microsoft 365: turn on security defaults
Security defaults are free in every Microsoft 365 plan and make every user set up two-step verification. Newer accounts often have them on already.
- Sign in to the Microsoft Entra admin center at entra.microsoft.com as a Global Administrator or Security Administrator.
- Go to Identity, then Overview, then the Properties tab.
- Select Manage security defaults, set it to Enabled, and select Save.
- The next time each person signs in, they'll be asked to set up the Microsoft Authenticator app. They have 14 days to do it.
On Microsoft 365 Business Premium? You can use Conditional Access instead, which gives more control. Microsoft recommends policies to require MFA for all users, require stronger MFA for admins, and block older sign-in methods. Keep two emergency admin accounts excluded, and only switch off security defaults once your Conditional Access policies are ready.
Google Workspace: allow, then enforce
- Sign in to the Google Admin console as a super administrator.
- Go to Menu, Security, Authentication, 2-step verification.
- Tick Allow users to turn on 2-Step Verification and save. Ask everyone to turn it on in their Google Account, under Security.
- Once people have enrolled, come back and set Enforcement to On, or pick a start date.
- Set a new user enrollment period, such as one week, so new starters have time to set it up.
- Under Methods, choose Any except verification codes via text, phone call if you can. App prompts and security keys are safer than text messages.
Don't forget your other apps
Cyber Essentials covers every cloud service you use for work, so switch on two-step verification in your accounting software, booking app, online banking, website builder, social media and domain provider too. Look for it under security or account settings.
Help your team
- Give a week's notice and a short how-to. Most people set it up in five minutes.
- Recommend an authenticator app, such as Microsoft Authenticator or Google Authenticator.
- Tell everyone never to approve a sign-in request or share a code they didn't ask for, and to report it straight away.
- Make sure at least two people can manage admin settings, so nobody gets locked out.
Common questions
Is two-step verification required for Cyber Essentials?
Yes. Since April 2026, missing two-step verification on any cloud service that offers it is an automatic fail, even where it's a paid extra.
Does Microsoft 365 charge for two-step verification?
No. Security defaults are free in every Microsoft 365 plan.
Are text message codes good enough?
They're much better than nothing, but authenticator apps, app prompts and security keys are safer.
Sources
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.