How to Set Up Multi-Factor Authentication (MFA) in Microsoft 365

Why does MFA matter for Microsoft 365?

Most Microsoft 365 account compromises begin with a stolen or guessed password, and MFA stops that attack cold by demanding a second proof of identity. Microsoft reports MFA blocks over 99% of account takeover attacks (Microsoft Security), which is why the NCSC lists it as a core control.

• 43% of UK businesses experienced a cybersecurity breach in 2025 (Cyber Security Breaches Survey 2025).
• Stolen or compromised credentials were the initial attack vector in 22% of data breaches in 2024 (Verizon DBIR 2025).
• The NCSC recommends MFA on every internet-facing account, prioritising admin access first.

A password-only Microsoft 365 tenant is one phishing email away from a full mailbox takeover. MFA makes a stolen password, on its own, useless to an attacker.

How does MFA work in Microsoft 365?

MFA requires two independent proofs at sign-in: something the user knows (their password) and something they hold or are (a device prompt or biometric). Microsoft 365 supports several second factors, and they are not equally secure — the method you choose changes how much protection you actually get.

Microsoft Authenticator is the right default for most staff. Since 2023, number matching is on by default: the user types a two-digit number from the sign-in screen rather than tapping "approve", which neutralises MFA fatigue (push-bombing) attacks. SMS is the weakest option because codes can be intercepted via SIM swapping.

What is the correct way to enable MFA — per-user or Conditional Access?

Enable MFA with a Conditional Access policy in Microsoft Entra ID, not the legacy per-user MFA toggle. Per-user MFA can be silently bypassed by legacy email protocols, while Conditional Access enforces MFA at the policy level and blocks those protocols at the same time.

Legacy protocols — IMAP, POP3 and basic SMTP authentication — authenticate with a password alone and ignore per-user MFA entirely. Microsoft reports over 99% of password-spray attacks target these legacy endpoints (learn.microsoft.com). Conditional Access shuts that door. Full Conditional Access needs Entra ID P1, included in Microsoft 365 Business Premium; Business Basic and Standard tenants can use Security Defaults, which enforces MFA for all users and blocks legacy auth in a simplified, preset form.

How should admin accounts be protected?

Admin accounts are the highest-value target in any tenant — a compromised Global Administrator hands an attacker the entire organisation. They need phishing-resistant MFA (FIDO2 keys or Windows Hello for Business), not just an Authenticator prompt, plus just-in-time role activation.

Phishing-resistant methods cannot be relayed through adversary-in-the-middle attacks, where a fake Microsoft sign-in page proxies the login in real time and captures the approval. Pair this with Privileged Identity Management (PIM), which limits admin role activation to time-boxed sessions with written justification and approval. Combined, these controls make admin compromise far harder. Only 14% of UK businesses have a formal incident response plan (DSIT Cyber Security Breaches Survey, 2024) — hardening admin access is the cheapest way to avoid ever needing one.

How do you roll out MFA without breaking the business?

A safe MFA rollout is staged: communicate first, deploy the Authenticator app, test policies in report-only mode, enforce on a pilot group, then expand tenant-wide. This catches the apps that rely on legacy authentication before you block it. AMVIA runs this end to end as part of our managed Microsoft 365 service.

• Communicate first — tell staff what is changing, why, and what they must do.
• Deploy Microsoft Authenticator — install and register methods before enforcement.
• Report-only mode — log what a new policy *would* do, with zero user impact.
• Pilot group — enforce for IT and early adopters to validate the experience.
• Full rollout — expand to all users with helpdesk cover on standby.
• Block legacy authentication — switch it off alongside or just after enforcement.

The usual snags are staff without a smartphone (use FIDO2 keys, phone-call or desktop TOTP), and service or shared accounts (handle with managed identities, app passwords, or documented Conditional Access exclusions). A short M365 security audit surfaces every legacy-auth app — old Outlook builds, scan-to-email printers, IMAP line-of-business tools — before anything gets blocked.

How does AMVIA set up and manage MFA?

AMVIA deploys and manages MFA for UK businesses as part of our Microsoft 365 security service: building Conditional Access policies, rolling out Microsoft Authenticator, auditing and blocking legacy authentication, procuring FIDO2 keys for admins, and running the helpdesk through the change. MFA is one layer of a zero trust model — verify every sign-in, trust nothing by default — which we extend with Microsoft Defender for Business. One provider. Security-first. Microsoft-certified. Call us on 0333 733 8050.