Passwords alone aren't enough to protect your accounts. Attackers routinely obtain passwords through phishing, data breaches, and credential-stuffing attacks — and when they do, a password is all they need to get in. Multi-factor authentication (MFA) changes that equation by requiring a second proof of identity that the attacker doesn't have.
Microsoft has reported that MFA blocks more than 99% of automated account attack attempts. It's one of the highest-impact security controls available, and it's available to every practice using Microsoft 365.
Multi-factor authentication means that logging into an account requires two or more different types of verification. These typically fall into three categories:
The most common setup is a password plus a code generated by an authenticator app on your phone (such as Microsoft Authenticator). Even if an attacker has your password, they can't log in without also having your phone.
The problem with passwords is that they can be stolen without you knowing. Phishing captures them in real time. Data breaches from other services expose them. Malware records them as you type. Password reuse — using the same password across multiple services — means a breach on one site can give attackers access to many others.
A strong, unique password helps. But it doesn't help if the attacker gets it through phishing or a breach on another platform.
For practices using Microsoft 365, this is the recommended option. Staff install the Authenticator app on their phone. When they log in, they get a push notification asking them to approve or deny the login attempt. It takes about three seconds and works reliably on both iOS and Android.
A one-time code is sent via text message. This is less secure than an authenticator app (SMS can be intercepted through SIM-swapping attacks) but is significantly better than no MFA at all. It's an acceptable option for lower-risk accounts.
A physical USB or NFC key (such as a YubiKey) that must be present to complete login. This is the most phishing-resistant form of MFA and is recommended for high-privilege accounts such as practice owners and admin accounts.
Watch out for MFA fatigue: Attackers have adapted to MFA by bombarding users with repeated approval requests, hoping someone clicks "Approve" to make it stop. Microsoft 365 lets you enable number matching — where you must enter a code shown on screen rather than just tapping Approve — which defeats this technique.
At a minimum, every account in your practice should have MFA enabled for:
The most common concern we hear is that staff will find MFA disruptive. In practice, once it's set up correctly, it adds about five seconds to the first login of the day. After that, most sessions don't prompt for MFA again unless the device or location changes.
A smooth rollout involves:
Shared accounts — where multiple staff log in with the same credentials — are a security risk regardless of MFA. They make it impossible to track who did what, and MFA becomes impractical when the authentication device isn't tied to a specific person. The right approach is individual accounts for every staff member, with appropriate permissions assigned to each role.
We check MFA coverage, configuration, and any gaps as part of our free security audit. Book one today.
Book your free audit