If you only make one security change this year, make it multi-factor authentication (MFA). Microsoft reports that MFA blocks more than 99% of automated account-compromise attacks.
Why passwords alone fail
Passwords are reused, guessed, phished and leaked in other companies' breaches. Attackers try millions of stolen username and password pairs against Microsoft 365 every day. Without MFA, one reused password is all it takes.
What MFA does
MFA asks for a second proof of identity, usually a tap on an authenticator app, when someone signs in from a new device or location. An attacker with your password still can't get in without your phone.
Rolling it out without the headaches
- Use an authenticator app rather than text messages where possible. It is faster and harder to intercept.
- Turn it on for everyone, especially owners and anyone who handles payments. They are the top targets.
- Use trusted devices and locations so staff aren't prompted constantly at their own desk.
- Plan for lost phones with a simple, verified process to reset MFA.
- Block legacy sign-ins that can bypass MFA entirely.
We roll out and manage MFA as part of our Secure and Complete plans, including user training and a help desk to call when someone gets a new phone.
Want a second opinion on your setup?
Book a free 30-minute IT and security assessment. You'll get a written report with your top risks, whether or not you hire us.