If your business uses Microsoft 365, there's a very good chance you've already come across Multi-Factor Authentication, or MFA. It's that extra step when you log in. You enter your password, then approve a notification on your phone, enter a code or use another method to confirm it's really you. For most of us, it's become part of everyday working life. Occasionally a little irritating when your phone is at the other end of the office, but considerably less irritating than somebody getting into your business email account!
And there's a very good reason for using it.
Multi-Factor Authentication for business is one of the simplest and most effective ways to reduce the risk of unauthorised access to company accounts.
But here's the question we get asked quite often... If we've got MFA enabled, are we protected?
Well... yes and no.
Traditionally, accessing an account meant entering a username and password. If somebody managed to steal those details, they could potentially log in as you. MFA adds another layer of verification. Depending on how your system is configured, that might involve :
👉 Approving a notification through Microsoft Authenticator
👉 Entering a code generated by an authentication app
👉 Using a fingerprint or facial recognition
👉 Authenticating with a security key
👉 Confirming your identity using a passkey
The idea is straightforward. Even if somebody gets hold of your password, they shouldn't automatically be able to access your account. The National Cyber Security Centre recommends MFA as an important part of protecting business accounts, particularly those containing sensitive information.
Because cyber criminals have become rather good at finding ways around security measures.
One example is something called MFA fatigue.
Imagine somebody has obtained your password and repeatedly attempts to log into your account. Your phone starts receiving authentication requests. You reject the first one. Then another arrives. And another.
Eventually, somebody might approve a request simply to make the notifications stop. There are also more sophisticated phishing attacks designed to capture login sessions rather than just passwords. A convincing fake Microsoft 365 login page can sometimes trick somebody into completing the authentication process, allowing an attacker to steal a session token and potentially access the account without needing to repeat the MFA challenge.
It's one of the reasons Microsoft recommends stronger, phishing-resistant authentication methods wherever practical.
This is worth understanding because businesses sometimes assume that enabling any form of MFA provides exactly the same protection.
It doesn't.
Text message codes, authentication apps, number matching, passkeys and physical security keys all offer different levels of protection.
For example, Microsoft Authenticator can use number matching, where you must enter a number displayed on the login screen rather than simply tapping Approve. This helps reduce the risk of somebody accidentally approving an unexpected login request. Phishing-resistant methods, such as FIDO2 security keys and appropriately configured passkeys, provide stronger protection against attacks involving fake login websites.
That doesn't mean every business needs to immediately replace its existing authentication methods. It does mean it's worth checking what you've actually got configured.
MFA is important, but it should be part of a wider approach to cyber security. For businesses using Microsoft 365, we'd generally recommend reviewing several areas.
Microsoft Entra Conditional Access can help control access to business systems based on factors such as the user, device, location and level of risk.
For example, you might want additional verification when somebody signs in from an unfamiliar location or restrict access from devices that don't meet your security requirements.
Would you know if somebody repeatedly tried to access one of your Microsoft 365 accounts?
Monitoring sign-in activity can help identify unusual behaviour, repeated failed attempts and potentially compromised accounts.
Technology can prevent an awful lot, but employees still need to recognise suspicious requests.
If your phone suddenly starts asking you to approve a login you haven't initiated, don't approve it.
And if somebody receives a suspicious email asking them to log into Microsoft 365, they should know how to check it safely.
Not everybody needs administrator access.
Businesses should regularly review user permissions, remove unnecessary access and make sure accounts belonging to employees who have left are properly disabled.
Even the strongest account security won't solve every problem if a device is compromised.
Endpoint protection, security updates, device management and monitoring all play an important part in keeping business systems secure.
This is probably the most useful question to ask.
You may have enabled MFA several years ago, but Microsoft 365 security has developed considerably since then.
Your users may still be relying on older authentication methods. Some accounts might have different security requirements, while others may have permissions they no longer need.
It's also worth checking that MFA is being enforced consistently, rather than assuming everybody is protected because most people receive an authentication prompt.
A review doesn't necessarily mean buying additional software or making complicated changes. Sometimes it's simply a case of checking your existing configuration and tightening up a few settings.
We'd never suggest switching MFA off. Quite the opposite! It's one of the most valuable security measures a business can implement, particularly when stronger authentication methods are used.
But good cyber security is about layers. If one protection fails, you want other measures in place to help prevent a small incident becoming a much bigger problem.
If you're not sure whether your Microsoft 365 accounts are properly protected, or you'd like somebody to review your existing MFA and security settings, have a chat with us. We can help you understand what's already in place, whether anything needs improving and what makes sense for your business.
And if your phone suddenly asks you to approve a login while you're making a cup of tea... perhaps check it really was you first! ☕😊
📧 support@espi.net
📞 01954 213999
➡️ Endpoint Detection and Response (EDR)
➡️ Remote Monitoring and Management (RMM)
