Key Takeaways
- MFA blocks the vast majority of automated credential attacks on its own.
- Start with an audit of your assets, users, and highest-risk access points before rolling anything out.
- Authenticator apps and hardware keys are stronger than SMS codes. Use SMS as a fallback, not the default.
- Conditional access policies mean staff on trusted devices are not prompted constantly, so the security holds without the friction.
- Admin accounts need the strictest enforcement. They are the accounts attackers actually want.
Why MFA matters
A password on its own is a single point of failure. The moment it is phished, reused from another breach, or guessed, an attacker is in. Multi-factor authentication adds a second, independent check, something the user has or is, so a stolen password stops being enough on its own. This is the single highest-impact control against automated credential attacks, which remain the most common way businesses get breached.
Single-factor authentication means one credential, almost always a password. MFA means at least two independent factors. CISA’s guidance on turning on MFA covers why this distinction matters for anyone handling sensitive data, and most compliance frameworks now treat MFA as a baseline requirement rather than an optional extra.
Before you turn anything on
Map what you have before you change anything. Document your systems, user roles, and access points so you know where the real gaps are, and which accounts carry the most risk if compromised.
Where to focus first
VPNs, admin consoles, and anything touching regulated or client data are the highest-value targets for an attacker, so they should get MFA first. If you run Microsoft 365, this is usually the fastest, highest-impact place to start.
Tell people what is changing, and why
Rolling this out without warning causes confusion and support tickets. A short internal note explaining why MFA is going on, what to expect, and who to contact if something breaks removes most of the friction before it happens.
Choosing the right method
Hardware security keys are the strongest option, resistant to most remote attacks, but they need physical distribution and replacement when lost. Authenticator apps are the practical middle ground for most staff: strong enough, and nothing to carry. Biometrics work well where the hardware already supports it, since there is nothing for a user to remember or lose.
SMS and email one-time codes are the weakest option and easiest to intercept. Keep them as a fallback for edge cases, not the default. Microsoft’s own MFA setup guidance pushes app-based verification for exactly this reason.
Setting it up
Integration with your identity provider is the backbone of the whole system. Get this wrong and users see inconsistent prompts across different applications, which trains them to distrust the prompts altogether, the opposite of what you want.
Conditional access, not blanket enforcement
Conditional access lets you vary the requirement by context: trusted office network, unfamiliar device, or a high-risk admin action.
| Scenario | Policy | Result |
|---|---|---|
| Known office network | Periodic MFA | Minimal friction |
| New or unrecognised device | Immediate MFA challenge | Stops account takeover attempts |
| High-risk admin action | Mandatory MFA plus audit log | Full accountability |
Test in a staging group first. Catching a configuration error there costs you nothing. Catching it after a company-wide rollout costs you a flood of lockout tickets.
Rolling it out to staff
Not every account needs the same level of enforcement. Admin accounts get the strictest policy, since they carry the most damage if compromised. Standard users can run a slightly lighter policy that favours usability without leaving the door open.
A phased rollout, rather than switching everyone on at once, gives your team time to catch the people who get stuck on enrolment before it becomes a mandatory requirement. Admin accounts should move to strict enforcement early. A successful password theft against an admin account with no second factor is the scenario that leads to a full compromise, not just one user’s inbox.
Keeping it running
Review authentication logs for the obvious warning signs: repeated failures, logins from unexpected locations, or patterns that do not match normal behaviour. Automated alerts on failed MFA attempts close the gap between something happening and someone noticing.
Revisit the configuration periodically. What was a sensible policy a year ago may not match how the business, or the threat landscape, looks today.
Common problems, and how to fix them
Time drift breaking codes
If a device’s clock falls out of sync with the identity provider, authenticator codes stop validating. This is a common, low-drama fix, but it causes real frustration if support does not recognise it quickly.
Lost or stolen devices
Have a clear process ready before this happens: revoke the device from the identity provider immediately, then re-enrol. Waiting to figure this out during the actual incident is how a lost phone becomes a real exposure.
Authenticator app not receiving prompts
Work through this in order:
- Check the device has a working internet connection.
- Confirm the app has permission to send background notifications.
- Clear the app’s local cache if prompts still are not arriving.
- Re-install and re-register the app if nothing else resolves it.
Frequently Asked Questions
Is MFA enough on its own to stop cyberattacks
No. It blocks the majority of automated credential attacks, but it needs to sit alongside endpoint monitoring and staff training to cover other attack paths like social engineering.
How often should staff be asked to re-authenticate
It depends on your risk profile, but most businesses require it after a password change or when signing in from a new device, with conditional access reducing prompts on already-trusted devices.
Can MFA be bypassed by phishing
Sophisticated phishing can trick a user into handing over an MFA code. Hardware keys or FIDO2-based authentication close this specific gap and are worth the investment for high-risk accounts.
What if a staff member does not have a smartphone
Provide a physical hardware key or token. Nobody needs to use personal equipment to stay protected.
Does MFA slow down logging in
Barely. Modern authenticator apps take a few seconds, and conditional access reduces how often trusted devices are even prompted.
Can MFA be rolled out to everyone at once
Technically yes, but a phased rollout is safer. It gives you room to catch enrolment problems before they become a wave of lockout tickets.
What should happen if an MFA device is compromised
Revoke it immediately from the identity provider, then run account recovery and a password reset to fully re-secure the account.
