Multi Factor Authentication: A Small Business Guide to MFA

Passwords on their own are no longer enough. They get reused, guessed, phished and leaked in data breaches every day, often without the owner ever knowing. Multi factor authentication, usually shortened to MFA, closes that gap by asking for a second piece of proof before letting anyone in.

For a small business, MFA on Microsoft 365 and other cloud services is one of the most effective security steps available, and it costs little or nothing to switch on. This guide explains how it works, which methods to choose and how to roll it out smoothly.

What is multi factor authentication?

Authentication is how a system checks you are who you say you are. Multi factor authentication asks for at least two different types of proof, known as factors:

• Something you know, such as a password or PIN
• Something you have, such as your phone or a physical security key
• Something you are, such as your fingerprint or face

The idea is simple. An attacker who steals your password from a phishing page or a leaked database still cannot sign in, because they do not have your phone or your fingerprint. You may also hear the terms two factor authentication (2FA) and 2 step verification. For everyday purposes they mean the same thing.

Types of MFA, from strongest to weakest

Not all MFA is equal. Here is how the common methods compare.

Why number matching matters

Older authenticator apps simply asked "Approve sign in?". Attackers with a stolen password learned to trigger prompt after prompt until a tired or distracted user tapped Approve, a technique known as MFA fatigue or push bombing. Microsoft made number matching mandatory for all Microsoft Authenticator push notifications in May 2023. You now have to type a number shown on the sign in screen, which means you can only approve a sign in you are actually looking at.

The trouble with text messages

SMS codes rely on the mobile network and your phone number, both of which can be attacked. In a SIM swap, a criminal persuades a mobile provider to move your number onto a SIM card they control, and your codes go straight to them. Microsoft's own identity team has described SMS and voice calls as the least secure MFA methods available. If text messages are your only option, use them, but move to an app or passkey when you can.

Passkeys

Passkeys are the direction of travel for sign ins. Instead of a password and a code, your device holds a private key that only ever works on the genuine website, and you unlock it with your face, fingerprint or PIN. Because there is nothing to type, there is nothing to hand over to a fake login page. Microsoft Entra ID, the identity system behind Microsoft 365, supports passkeys stored in the Microsoft Authenticator app and on hardware security keys.

Rolling out MFA in Microsoft 365

Microsoft 365 gives you two main ways to require MFA.

• Security defaults is a free setting that switches on a baseline of protections, including requiring all users to register for MFA using the Microsoft Authenticator app and blocking older sign in methods that cannot do MFA. It is a good starting point for very small businesses.
• Conditional Access is included in Microsoft 365 Business Premium and some other plans. It lets you set precise rules, for example requiring phishing resistant MFA for administrators, blocking sign ins from countries you do not work in, or only allowing access from company managed devices.

Microsoft now also requires MFA for its main admin portals, so anyone who manages your tenant must use it regardless of your own settings.

A sensible rollout for a business of 5 to 100 staff looks like this:

1. Start with administrators. Admin accounts are the most valuable target and should use the strongest method you have.
2. Tell staff what is changing, why it matters and when it will happen. A short explanation prevents most of the frustration.
3. Give people a registration window and help them set up the Authenticator app, ideally in person or on a short call.
4. Ask everyone to register at least two methods, such as the app and a backup method, so a lost phone does not lock them out.
5. Switch enforcement on, then remove older sign in methods that bypass MFA.
6. Keep two emergency access admin accounts, stored securely and excluded from rules that could lock everyone out, and monitor their use.

Staff without a work smartphone

Not everybody has a company phone, and some staff reasonably prefer not to install work apps on a personal device. You have good options:

• Hardware security keys that plug into a USB port or tap against a phone. They support passkeys and are the most phishing resistant method.
• Hardware tokens that display a changing code, which Microsoft Entra ID supports.
• Windows Hello for Business on the person's work computer for signing in at their desk.
• A low cost company phone dedicated to work apps, which also keeps work data off personal devices.

For shared devices on a shop floor or warehouse, talk to your IT provider about the right approach, as shared accounts and MFA need careful planning.

Common MFA mistakes to avoid

• Leaving gaps. MFA on Microsoft 365 but not on your accounting software, payroll, banking or domain registrar leaves an open door. Cyber Essentials expects MFA on every cloud service that offers it.
• Exempting the boss. Directors and finance staff are prime targets. They need MFA more than anyone.
• Forgetting legacy sign ins. Old email protocols that cannot do MFA must be switched off, otherwise attackers simply use them instead.
• Approving unexpected prompts. Teach staff that an MFA prompt they did not start means someone has their password. They should deny it and tell IT straight away.
• No plan for lost phones. Agree a secure process for verifying someone's identity before resetting their MFA, so the help desk cannot be talked into helping an attacker.
• Treating MFA as the finish line. Some phishing kits can steal a session after you sign in. MFA should sit alongside email security, device management and staff awareness, not replace them.

How Cyber Fits can help

Cyber Fits sets up and manages MFA across Microsoft 365 and other business systems for organisations in Sunderland and throughout the North East, and helps teams through the change so it sticks. If you are not sure how well your accounts are protected, our free IT review includes a check of your sign in security, and our Microsoft 365 and cyber security pages explain more about how we work.