Executive Briefing
MFA blocks 99.9% of account attacks. Learn to roll out multi-factor authentication across your organisation with minimal disruption to operations.
Why MFA Matters
Passwords alone are no longer sufficient protection. Billions of stolen credentials circulate on the dark web. Attackers use credential stuffing, phishing, and password spraying to compromise accounts. MFA adds a second verification layer that stops most attacks even when passwords are compromised.
""MFA can block over 99.9% of account compromise attacks. If you have MFA enabled, you are significantly less likely to be compromised." — Microsoft Security Research"
Understanding MFA Methods
Authentication Apps (Recommended)
Apps like Microsoft Authenticator, Google Authenticator, or Authy generate time-based one-time codes or push notifications. This is the recommended method for most businesses—it's secure, free, and doesn't require mobile phone signal.
SMS Text Messages
Codes sent via SMS are better than no MFA but are the weakest option. SMS can be intercepted through SIM swapping attacks. Use SMS only as a fallback, not your primary MFA method.
Hardware Security Keys (FIDO2)
Physical keys like YubiKey provide the strongest protection and are phishing-resistant. Ideal for high-value accounts like administrators and executives. Cost $50-80 per key.
Biometrics
Windows Hello for Business uses facial recognition or fingerprint scanning. Convenient and secure when combined with device trust policies.
Microsoft 365 MFA Implementation Steps
- 1Assess your current state: Check which users already have MFA enabled in the Microsoft 365 Admin Center under Users > Active Users.
- 2Choose your approach: Security Defaults (free, simple, automatic) or Conditional Access (more control, requires Azure AD P1/P2 or Business Premium).
- 3Communicate with users: Announce the change at least two weeks before enforcement. Explain why MFA is important and how it protects them personally.
- 4Provide setup guidance: Create simple instructions with screenshots for installing Microsoft Authenticator and completing MFA registration.
- 5Enable MFA registration: Start with a pilot group (IT team, willing early adopters) before rolling out company-wide.
- 6Set an enforcement deadline: Give users a registration window, then enforce MFA. Legacy authentication protocols must be blocked.
- 7Support users through transition: Expect questions in the first week. Have IT support ready to assist.
- 8Monitor and maintain: Review MFA registration status regularly. Ensure new users are enrolled promptly.
Security Defaults vs Conditional Access
Security Defaults (Recommended for Basic Protection)
- Free with all Microsoft 365 plans
- Requires MFA for all users
- Blocks legacy authentication automatically
- Simple on/off toggle
- Limited customisation options
Conditional Access (Recommended for Advanced Control)
- Requires Microsoft 365 Business Premium, E3, or Azure AD P1/P2
- Risk-based policies (require MFA only when risk detected)
- Location-based rules (trust office network, require MFA elsewhere)
- Device compliance requirements
- App-specific policies
Important Note
Pro tip: If you're on Microsoft 365 Business Basic or Standard, enable Security Defaults immediately. If you have Business Premium or higher, invest time in Conditional Access for more intelligent security.
Common Challenges and Solutions
User Resistance
Some users see MFA as inconvenient. Counter this by explaining it protects their personal data and work, not just the company. Modern MFA with push notifications takes just seconds. Consider the Microsoft Authenticator's "number matching" feature for quick approvals.
Lost Phones
Users lose phones or get new devices. Ensure backup methods are configured—alternative phone numbers, backup codes, or multiple registered devices. Admins can reset MFA when needed.
Legacy Applications
Some older applications don't support modern authentication. Identify these during planning and either upgrade them, use app passwords (less secure), or accept the risk and document it.
How We Researched This Article
This article was compiled using information from authoritative industry sources to ensure accuracy and relevance for Australian businesses.
Sources & References
-
→
Microsoft Security - MFA
Microsoft documentation on multi-factor authentication
-
→
Australian Cyber Security Centre - MFA Guidance
ACSC guidance on implementing MFA as part of Essential Eight
-
→
NIST Digital Identity Guidelines
US Government standards for digital authentication
-
→
CISA MFA Guidance
US cybersecurity agency recommendations for MFA implementation
* Information is current as of the publication date. Cybersecurity guidelines and best practices evolve regularly. We recommend verifying current recommendations with the original sources.
Frequently Asked Questions
What if an employee doesn't have a smartphone? ▼
Alternatives include hardware security keys, phone calls to a landline, or SMS to a basic mobile phone. Microsoft Authenticator can also run on tablets. For a small number of users, hardware keys may be the best solution.
How do I handle MFA for shared accounts? ▼
Shared accounts are problematic for MFA and security generally. The best practice is eliminating shared accounts where possible. Where they must exist, use a shared mailbox instead (which inherits MFA from accessing users) or a hardware key stored securely.
Does MFA slow down work? ▼
Initial setup takes users 5-10 minutes. Daily impact is minimal—push notifications take seconds. Features like "remember device for 14 days" reduce prompts on trusted devices. Users adapt quickly, and the security benefit far outweighs minor inconvenience.
What happens if someone's account is already compromised? ▼
If you suspect compromise, immediately reset the user's password and revoke all active sessions. Then have them re-register MFA methods (attackers may have registered their own). Review sign-in logs for suspicious activity and check for mailbox rules forwarding emails.