If you take one thing from this post, it's this: multi-factor authentication on Microsoft 365 stops 99.2% of automated account-takeover attacks (Microsoft's own published figure, based on their telemetry across millions of accounts). It is the single highest-impact security control you can turn on. It's free. And most UK SMEs we audit still haven't fully deployed it.
This is the version of the MFA conversation we have with new clients on day one.
What MFA actually is (in 30 seconds)
Instead of just a password, signing in requires a second factor, usually a code or push notification from an app on your phone. Even if an attacker has your password (from a phishing email, a data breach, or guessed it), they can't get in without that second factor.
Microsoft 365 supports several second factors:
- Microsoft Authenticator app (push notifications), best for most people
- TOTP codes from any authenticator app (Google Authenticator, 1Password, Authy)
- FIDO2 security keys (YubiKey etc.), strongest, used for admins and high-risk staff
- SMS text messages, works, but the weakest option and increasingly retired
- Phone call, same caveats as SMS
Why the "we're too small to be a target" argument is wrong
The attacks we see hitting SMEs are not targeted. They're automated, untargeted, and continuous. Your business email gets hammered by credential-stuffing attempts every single day, using passwords leaked from other breaches.
Without MFA, the moment one of your users reuses a password that's been leaked elsewhere, an attacker is in your mailbox. From there it's invoice fraud, payroll diversion, or a launchpad to phish your customers from your real address. We've cleaned up the aftermath of all three this year alone.
We cover the broader threat landscape on our cyber security service page.
Rolling out MFA properly, the bit that goes wrong
Most "we tried MFA but it caused chaos" stories are roll-out problems, not MFA problems. Here's how we do it:
1. Pick the right method
Default everyone to Microsoft Authenticator with number matching. Number matching (where the user has to type a number from the sign-in screen into their phone) defeats "MFA fatigue" attacks where bad actors spam push prompts hoping someone hits Approve by accident.
2. Use Conditional Access, not Security Defaults
Microsoft's "Security Defaults" turn MFA on for everyone instantly. That works for tiny businesses but breaks shared mailboxes, room accounts and service accounts. Better: Conditional Access policies (requires Business Premium or Entra ID P1) so you can require MFA based on risk, location, app and user group.
3. Communicate before you enforce
Two emails, a 15-minute Teams briefing, a one-page PDF. People hate surprises. We provide a templated rollout pack to every client we onboard, see our IT support page for what onboarding looks like.
4. Set up the registration window properly
Give users 14 days from first sign-in to register their authenticator. After that, enforcement kicks in. Don't do it on a Friday afternoon. Don't do it the week of month-end.
5. Have a break-glass account
Always keep one cloud-only Global Admin account, with a long random password stored in a password manager, excluded from MFA, for the day your auth breaks. Never use it for anything else. Audit its sign-ins monthly.
The gotchas nobody warns you about
- Shared mailboxes, these don't need their own licence or MFA. Disable sign-in on the underlying account entirely.
- Application passwords, old apps that don't support modern authentication (legacy Outlook, certain scanners, certain VoIP integrations) will break. Audit and remove them before enforcing MFA.
- Conference room phones / Teams Rooms devices, need certificate-based or device-based exemptions, set up in Conditional Access.
- MFA fatigue, without number matching, attackers spam push notifications. Always enable number matching.
- Lost phones, you need a written process for resetting MFA quickly without compromising security. Helpdesk needs the runbook.
What "good" looks like for a UK SME
- 100% of users on MFA, no exceptions (except one audited break-glass admin)
- Microsoft Authenticator with number matching as the default method
- Conditional Access policies blocking sign-ins from countries you don't operate in
- FIDO2 keys for admins and finance team
- Quarterly review of MFA registration to catch new starters and changes
If you're not at that standard, you're carrying risk that's entirely free to fix.
Frequently asked questions
What if a user refuses to install Authenticator on their personal phone? Microsoft Authenticator only needs network access to receive a push, it doesn't give your business any access to their phone. If they're still uncomfortable, issue a hardware token (Yubico Security Key, ~£25) and require it for sign-in.
Does MFA stop phishing? Standard MFA reduces it dramatically but doesn't eliminate it, modern phishing kits can intercept MFA codes in real time. To truly stop phishing, combine MFA with phishing-resistant methods (FIDO2 keys, certificate-based auth) for high-risk users, plus Conditional Access policies.
What about MFA for our line-of-business apps? If they integrate with Microsoft 365 single sign-on (SAML, OAuth), they inherit MFA automatically. Apps with their own logins need their own MFA, increasingly available in Sage, Xero, Salesforce, HubSpot etc.
How long does a full MFA rollout take? For a 30-person business: 2 weeks of comms and prep, 2 weeks of registration window, then enforcement. So about a month, with no business disruption if planned properly.
Need a hand getting MFA right?
We do MFA reviews and rollouts for businesses across Birmingham, Solihull and the West Midlands, including the Conditional Access policies, the Authenticator deployment and the user comms. Book a 15-minute call or have a look at our cyber security service page.
MFA is one half of good mailbox hygiene. The other is knowing what to do when something goes out in error, see how to recall an email in Outlook.