Guides · About 90 minutes · Updated draft Oct 2026

Lock down Microsoft 365 nonprofit in 90 minutes

You have a church Microsoft 365 tenant (often via nonprofit licensing). This playbook gets you to a sane baseline: MFA on, legacy auth blocked, fewer Global Admins, no mystery accounts. It assumes you already have Global Admin access and that most staff use Outlook on the web or modern Outlook/Office apps.

Before you start: pick a 90‑minute window when the pastor and office staff can take a phone call. MFA enrollment will interrupt sign‑ins. Have a second admin account ready so you cannot lock yourself out. Nonprofit program details live at nonprofit.microsoft.com (eligibility and offers change—confirm yours there).

What “done” looks like

Minutes 0–15: inventory and break-glass

  1. Sign in to the Microsoft 365 admin center with an admin account.
  2. Users → Active users: export or screenshot the list. Note shared mailboxes and any “info@ / office@” accounts.
  3. Create or confirm a second Global Admin (“break glass”) with a long unique password stored in a sealed envelope or church password manager—not a personal Gmail recovery. Limit standing Global Admins; see Microsoft’s guidance on about admin roles.
  4. Tell staff: “In the next hour you may be asked to set up the Microsoft Authenticator app. Use your work account.”

Minutes 15–35: turn on Security Defaults (MFA + block legacy auth)

For most small churches on Microsoft Entra ID Free, Security Defaults is the right lever. It requires MFA registration, requires MFA for admins, and blocks legacy authentication protocols. Official overview: Configure security defaults. How it fits Microsoft 365 MFA options: Multifactor authentication for Microsoft 365. Setup paths: Set up multifactor authentication.

  1. Open the Microsoft Entra admin center (from the M365 admin center → Show all → Identity / Entra, or go via Microsoft’s Entra portal once signed in).
  2. Go to Entra ID → Overview → Properties (wording can vary slightly) → Manage security defaults.
  3. Set Security Defaults to Enabled / On. Save.
  4. If the portal says you cannot enable Security Defaults because Conditional Access policies exist, stop—do not fight it in this 90‑minute window. Either (a) you already have stronger CA policies, or (b) schedule a longer session. Microsoft notes you use Security Defaults or Conditional Access, not both. Blocking legacy auth with CA is documented here: Block legacy authentication with Conditional Access.
What breaks? Old phones using basic auth for email, ancient Office 2010‑era clients, and some copiers/scanners that SMTP‑auth with the user’s password. Prefer modern clients. For devices that must send mail, plan app passwords only if your licensing still allows them—or use a proper SMTP relay designed for devices (out of scope for this hour).

Minutes 35–55: get humans through MFA enrollment

  1. Have each staff/volunteer with a mailbox install Microsoft Authenticator on their phone (App Store / Play Store).
  2. They sign in at aka.ms/mfasetup or wait until prompted, then add the work account and complete registration. Microsoft’s get‑started MFA doc: Plan a Microsoft Entra multifactor authentication deployment.
  3. Sit with anyone who is stuck (common: they try a personal Microsoft account instead of the church account).
  4. Admins should expect MFA on every admin sign‑in under Security Defaults—keep Authenticator handy.

Minutes 55–75: clean users and admins

  1. Remove leavers. For people who left the church staff/volunteer roles: follow Microsoft’s offboarding flow starting from Remove a former employee (block sign‑in, reset password, save needed mail/files, then delete or convert as appropriate).
  2. Shared vs personal. Prefer shared mailboxes for office@ / info@ instead of a shared password on a user license when your plan allows it.
  3. Admin diet. In Roles, ensure only the break‑glass + one working admin are Global Admins. Everyday pastor/office work should use a normal user license without Global Admin.
  4. Add users carefully. When you must create accounts: Add users—never reuse passwords across people.

Minutes 75–90: mail hygiene pass + Secure Score snapshot

  1. In the admin center, review external forwarding / auto‑forward policies for your org. If you do not have a documented need to auto‑forward church mail to personal Gmail, turn that capability off or restrict it. (Exact menu names move; search admin center help for “auto forwarding”.)
  2. If you have Microsoft Defender for Office 365 features on your SKU, review anti‑phishing concepts here: Anti-phishing policies and configuration guidance: Configure anti-phishing policies. Even without premium Defender, Security Defaults + MFA already remove a large share of account‑takeover risk.
  3. Open security.microsoft.com → Microsoft Secure Score (if shown for your tenant). Snapshot the score and the top recommended actions. Overview: Microsoft Secure Score. Pick one follow‑up item for next Saturday—do not boil the ocean today.
  4. Send staff a three‑line email: Security Defaults is on; use Authenticator; IT will never ask for your MFA code.

Copy-paste: staff announcement

Subject: Church email — MFA is required starting today

Team,
We turned on Microsoft security defaults for our church Microsoft 365 accounts.
You will be asked to register Microsoft Authenticator (or a compatible app).
Please finish that today. We will never ask you to read an MFA code aloud or send it by email/text.

If something looks urgent and asks for gift cards or codes, call the office to verify.
— Church tech

Done checklist

Next Saturday (optional follow-ups)

Menus in Microsoft portals change. When a click-path differs, trust the linked Microsoft Learn articles over this page. This is educational guidance, not a substitute for a formal security assessment.