Multi-factor authentication (MFA)

What it is

Microsoft describes MFA as requiring two or more of three things: something you know (a password), something you have (a phone or hardware key) and something you are (a fingerprint or face scan). If an attacker gets hold of a password through phishing or a breach elsewhere, they still need the second factor.

Not all MFA is equally strong. The NCSC ranks the common methods in this order:

1. FIDO2 credentials, such as passkeys and security keys
2. Authenticator apps that send a challenge to approve
3. App-based code generators
4. Hardware code generators
5. Codes sent by email, text message or phone call, which it says are only likely to be appropriate when nothing better is possible

Why it matters for a UK small business

A small business account protected only by a password is one phishing email away from being taken over. Microsoft says MFA together with blocking legacy sign-in stops more than 99.9% of common identity-related attacks.

It is now also a certification requirement. From 27 April 2026, Cyber Essentials requires that authentication to cloud services always uses MFA, and cloud services can’t be left out of scope. The requirements note that text message codes are better than nothing, but recommend other methods where they will work.

How it works in Microsoft 365

On Business Basic or Standard, Security Defaults requires every user to register for MFA, always requires it for administrators, and blocks legacy sign-in methods that can’t do MFA. On Business Premium you replace Security Defaults with Conditional Access policies, which let you require MFA everywhere while handling exceptions properly. Microsoft Authenticator uses number matching to make it harder to approve a prompt by mistake. For admin accounts, consider phishing-resistant MFA.

How &DEV helps: the Microsoft 365 MOT rolls MFA out to every account and blocks the sign-in methods that get around it, without locking anyone out.