Multi-factor authentication (MFA) for SMEs

A password on its own can be guessed, reused on another site, stolen through phishing or found in a data leak. Multi-factor authentication (MFA) adds a second element: an app, a physical key or a code. Without that second element, the password is no longer enough to sign in.

It is one of the most effective and least expensive measures for an SME. Above all it requires preparation, so that the rollout does not lock anyone out.

Methods, from weakest to strongest

Not all methods are equal: some resist phishing, others do not.

Where to start

• Administrator accounts first, with the strongest method.
• Then every user, with no lasting exceptions.
• Blocking legacy authentication protocols (POP, IMAP, basic authentication), which bypass MFA.
• Shared accounts and service accounts: each one needs an owner and suitable protection.

Security defaults or Conditional Access

In Microsoft 365, security defaults are free: they enforce MFA and block legacy protocols. That is a solid baseline for a small organization.

Conditional Access, included in Microsoft 365 Business Premium (through Entra ID P1), goes further: it adapts the requirements to the device, the location or the risk level of the sign-in, for example by allowing access to data only from a managed computer.

Rolling it out smoothly with your teams

• Announce the date and explain the reason, in a few lines.
• Plan an assisted enrollment session rather than an e-mail with instructions.
• Settle the question of personal phones: an app on a personal device, or a physical key supplied by the company.
• Register two methods per person, so nobody is locked out if a phone is lost.
• Write down the recovery procedure, including identity verification.

Limits to be aware of

Standard MFA does not protect against everything: some attacks hijack the session after sign-in, using a fake page that relays the exchange. Phishing-resistant methods and identity threat detection and response (ITDR) then complete the protection.