Key takeaways
- A stolen password alone should never be enough to sign in
- Start with email, remote access, admin and banking accounts
- Prefer passkeys, security keys or number matching over text codes
- Register two methods per person to avoid lockouts
How MFA works
MFA combines two or more kinds of proof: something you know, such as a password; something you have, such as a phone or a security key; and something you are, such as a fingerprint.
Passwords leak through phishing, data breaches and reuse across sites. With MFA turned on, an attacker who has the password still needs the second factor, which is why CISA urges every organization to require it.
MFA methods, strongest first
Passkeys and security keys
Phishing resistant. The sign-in is tied to the real website, so a fake page cannot capture and replay it.
Authenticator app with number matching
Strong for most staff. Typing the number shown on screen stops people from approving prompts they did not start.
Authenticator app codes
Good, though a convincing fake sign-in page can still ask for the code and use it.
Text message or phone call codes
Better than a password alone, but open to SIM swapping and interception. Use them only where nothing stronger is offered.
Where to turn it on first
- Email and Microsoft 365, for every user
- Remote access: VPN, remote desktop and remote support tools
- Admin accounts, kept separate from everyday logins
- Banking, payroll and payment platforms
- Backup consoles, the domain registrar and DNS accounts
- Line-of-business apps that hold client data
Rolling it out without friction
Announce the change and the reason for it before the switch. Help each person register two methods, so a lost phone does not lock them out. Turn off legacy sign-in methods that skip MFA, and use conditional access so trusted, managed devices see fewer prompts.
Expect a short burst of questions in the first week. Most of them come from new phones and from people who skipped enrollment.
How we help
MFA is part of the security baseline we set for every client. Microsoft 365 administration covers MFA, conditional access and safe sharing defaults, and the help desk handles password and MFA problems for every supported user. Password management is available as an add-on for teams that need a shared, encrypted vault.
Sources
- CISA: Require multifactor authentication
- CISA: Cyber Essentials
- CISA: Resources for small and medium businesses
Information on this page is general and is not legal or compliance advice.