What MFA is
Multi-factor authentication means signing in needs two things: something you know (your password) and something you have (your phone, a security key) or are (a fingerprint). Even if a criminal steals your password, they can't get in without the second factor.
Since the April 2026 update to Cyber Essentials, having no MFA on a cloud service that offers it is an automatic fail. See Cyber Essentials explained.
Which method to use
| Method | Strength | Notes |
|---|---|---|
| Passkeys / FIDO2 security keys | Strongest | Phishing-resistant; ideal for admins and finance |
| Microsoft Authenticator app (number matching) | Strong | The sensible default for most staff |
| SMS / phone call codes | Better than nothing | Vulnerable to SIM-swap and phishing; avoid where you can |
Turning it on in Microsoft 365
- Small businesses: Microsoft's security defaults (in the Microsoft Entra admin centre) require MFA for everyone at no extra cost. It's the quickest win.
- Businesses on Business Premium (or Entra ID P1): use Conditional Access policies instead. They allow finer control, for example stricter rules for admins and blocking risky locations.
- Plan the rollout: tell staff what's coming, help them install the Authenticator app, and register methods before enforcing.
- Don't forget shared and admin accounts — they're the most valuable targets.
- Keep break-glass accounts (emergency admin accounts), documented and protected, so you can't lock yourself out.
Beware MFA fatigue
Attackers who already have a password sometimes trigger repeated sign-in prompts, hoping someone taps "Approve" to make them stop. Number matching (typing a number shown on screen) defeats most of this. Teach one rule: if you didn't just try to sign in, deny it and tell IT, because your password is compromised.
