Invite your team, and the multi-factor rule

Add the people who will use the product, give each one a role, and let them enrol.

How to do it

In the tenant admin, open People and add each person by name and work email. They arrive as invited. They become active when they have set up sign-in and enrolled in multi-factor authentication.

If you use single sign-on, they sign in with your identity provider instead of a password. Multi-factor still applies.

The rule that has no exception

An active account has multi-factor enrolled. Not "should have". There is no column to switch it off, no status that keeps somebody working without it, and no administrator setting that grants an exemption.

This comes up most often as a request for one person, usually the one who travels or the one whose phone is old. The answer is the same for that person as for everybody else, and the reason is that an exemption is a permanent hole opened for a temporary inconvenience, in the account most likely to be worth attacking.

What proves it worked

Look at the People list. Every account showing active has an enrolment date beside it. An account without one cannot be showing active, and if you ever see one that is, that is a fault worth telling us about immediately.

Roles

A role is not a list of buttons. It sets how far across your business a person can see each kind of record: their own, their team's, their office's, or all of it. Some kinds of record a role cannot see at all, which is a real setting rather than an empty list.

That distinction matters most on totals. A person whose role narrows what they can see also gets narrowed totals, computed from what they can see rather than filtered after the fact.

When somebody leaves

Suspend the account rather than deleting it. Their record of what they did stays attached to the work, which is what you need six months later, and their access ends immediately.