Attackers rarely break in by defeating clever technology. They log in. A password reused from another site, guessed from a list or captured by a fake page is all they need. MFA, or multi-factor authentication, ensures that a password by itself is not enough.
How credentials are stolen
- Phishing. A convincing email leads to a fake sign in page.
- Reuse. A password leaked in an unrelated breach is tried on your accounts. Dark web monitoring can warn you when credentials appear in leaked data.
- Guessing. Automated tools try common passwords against thousands of accounts.
- Malware. Software on an infected device records what is typed.
What MFA does
MFA asks for something beyond the password: a code or approval on a phone, a security key or a fingerprint. Even if the password is stolen, the attacker cannot complete the sign in. Read our 2FA page for the basics.
Not all MFA is equal
| Method | Strength | Notes |
|---|---|---|
| Text message code | Basic | Better than nothing, but can be intercepted |
| Authenticator app prompt | Good | Use number matching to prevent accidental approvals |
| Hardware security key | Excellent | Resists phishing |
| Passkeys | Excellent | Replace passwords with device based sign in |
Attackers have learned to exhaust users with repeated prompts. Use number matching and train staff never to approve a request they did not start.
Make it smart with conditional access
Requiring MFA every minute frustrates people. Conditional access in Microsoft Entra ID applies the right level of checking based on risk: a known company laptop in the usual location may pass easily, while a new device in another country is blocked or challenged. See our conditional access page.
MFA and zero trust
Zero trust security assumes no sign in is automatically safe and verifies identity, device and context every time. MFA is its foundation. Our zero trust guide explains the wider model.
Roll it out well
- Start with administrators and email, then extend to everyone.
- Cover remote access, cloud applications and VPN.
- Explain why, with short instructions.
- Provide a backup method and a clear process for lost phones.
- Disable older sign in methods that skip MFA.
- Monitor sign ins and review exceptions regularly.
Combine with other defences
MFA stops stolen passwords but not every attack. Add phishing protection for email, keep devices updated and train staff to recognise scams. Our email protection service works well alongside it.
Do you already have it?
Many organisations believe MFA is on and discover gaps: service accounts, old protocols, shared mailboxes or executives excluded for convenience. A cybersecurity assessment will check.
We review sign in security and configure MFA and conditional access properly.
Explore cyber securityFrequently asked questions
Will MFA annoy my staff?
Properly configured with conditional access, it adds a few seconds on a trusted device.
Is MFA expensive?
Microsoft 365 includes MFA capabilities, so cost is mainly planning and support.
What if someone loses their phone?
Provide an approved recovery process that verifies identity.
Related service: Cyber Security Assessment
Last updated
