dForts blog: Microsoft 365, security and AI for SMBs Practical articles on Microsoft 365, cybersecurity, Copilot and automation, written by dForts certified consultants in Valencia, Spain. https://www.dforts.com/en/blog/ 2026-09-16T00:00:00.000Z dForts MFA in Microsoft 365: why your SMB needs it and how to roll it out without locking anyone out https://www.dforts.com/en/blog/mfa-microsoft-365-smb 2026-09-16T00:00:00.000Z 2026-09-16T00:00:00.000Z Sergio Cánovas Multi-factor authentication stops most unauthorized access to Microsoft 365 accounts. How to enable it in a small business step by step, without leaving anyone locked out. If your company runs on Microsoft 365 and some accounts still sign in with just a password, this article is for you. Multi-factor authentication (MFA) is the security measure with the best effort-to-benefit ratio available today, and rolling it out properly doesn't have to be painful.

What problem it solves

Passwords leak. No matter how strong they are: they show up in breaches of other services, they get reused, and a well-crafted phishing email gets them. With MFA, even if someone has the password, they also need something only the user has (usually their phone) to get in.

In practice, most of the unauthorized access we see in SMB tenants involves accounts without MFA. With MFA on, the attacker stays at the door.

The three ways to enable it

Microsoft 365 offers several routes, from least to most control:

  1. Security Defaults. One switch. Requires MFA for everyone and blocks legacy authentication. Free, included in every plan. Ideal if you don't have Entra ID P1 licenses.
  2. Conditional Access. Rules like "require MFA except from the office" or "block countries we never work from". Requires Entra ID P1, which is included in Microsoft 365 Business Premium and in E3/E5.
  3. Per-user MFA (legacy). Still exists, but Microsoft is retiring it. Don't start here.

For most SMBs the answer is simple: if you have Business Premium, Conditional Access; if not, Security Defaults.

How to roll it out without locking anyone out

The usual fear is "tomorrow nobody will be able to sign in". A bit of order avoids it:

  • Give a week's notice and explain what will happen: on sign-in, users will be asked to set up the Microsoft Authenticator app.
  • Prepare admin accounts first. They matter most and get attacked most.
  • Shared accounts and service mailboxes: identify them beforehand. The usual move is to convert them into shared mailboxes with sign-in disabled, not to put MFA on them.
  • Printers, scanners and legacy apps that send email over SMTP don't support MFA. They need a connector or an app password, and are worth reviewing one by one.
  • Keep an emergency (break-glass) account excluded from the rules, with a long password stored outside the tenant.

Methods: what to recommend

Method Security Convenience Recommendation
Microsoft Authenticator (number matching) High High The default choice
Passkey (Authenticator or FIDO2 key) Very high High Admins first, then everyone
SMS Low High Temporary backup only
Voice call Low Medium Avoid

Passkeys: the next step

Microsoft is clearly pushing towards a passwordless world, and in Microsoft 365 you can already work that way today. A passkey is a FIDO2 credential that lives on the phone, the computer or a hardware key, unlocked with the device's fingerprint, face or PIN. There is no password to steal and no code to type: the user approves the sign-in on their device and that's it.

What matters for an SMB:

  • It resists phishing. A passkey only works on the site it was created for. Even if a user lands on a fake Microsoft page, it cannot be used there. Not even the Authenticator app with push notifications guarantees that.
  • It's already included. Entra ID supports passkeys in Microsoft Authenticator (iOS and Android) and FIDO2 security keys with no extra licensing; you enable it from the tenant's authentication methods.
  • It's more convenient than MFA. One gesture on the phone replaces password + code. In practice, users welcome it more than they fear it.
  • Start with admins and sensitive roles, using Conditional Access to require a "phishing-resistant authentication strength" for them. Then roll it out to everyone else.

MFA remains the mandatory first step; passkeys are the destination worth reaching over the next year.

After enabling it

MFA isn't the end. The natural next steps are blocking legacy authentication (if Security Defaults hasn't already), reviewing who holds the Global Administrator role, and enabling risky sign-in alerts. But that's another article.

If you'd like us to review your tenant before touching anything, the free audit includes exactly this check.

]]> Shared mailboxes in Microsoft 365: when they save you a license and when they don't https://www.dforts.com/en/blog/shared-mailboxes-vs-licenses 2026-09-02T00:00:00.000Z 2026-09-02T00:00:00.000Z Sergio Cánovas info@, sales@, support@… A shared mailbox in Exchange Online needs no license, but it has limits. When to use one, when not to, and how to convert a user mailbox. Almost every company has addresses that belong to nobody in particular: info@, accounts@, support@. And in many tenants each one sits behind a fully licensed user that nobody uses for anything else. That's money down the drain, and one more account to protect.

What a shared mailbox is

A shared mailbox is an Exchange Online mailbox with no user attached. Nobody signs in to it: team members see it inside their own Outlook and can read and send as that address. It needs no license as long as it stays under 50 GB and doesn't use archiving or litigation hold.

When it fits

  • Generic addresses handled by several people (info@, orders@).
  • Mailboxes of former employees that must be kept for a while without paying a license.
  • Resource calendars: rooms, vehicles, loanable equipment.

When it doesn't

  • If someone needs to sign in directly to that mailbox (phone, Teams, applications).
  • If it will exceed 50 GB or needs an online archive: then it must be assigned an Exchange Online Plan 2 license or similar.
  • If it's used to send from a device (scanner, ERP) over authenticated SMTP: it can't authenticate because it has no password.

Converting a user mailbox into a shared one

It's a reversible change with no data loss:

  1. In the Exchange admin center, open the user's mailbox and choose Convert to shared mailbox.
  2. Wait for the conversion to finish (a few minutes).
  3. Grant Full Access and Send As permissions to the people who need to use it.
  4. Remove the license from the original user. If they have data in OneDrive, save it first: OneDrive isn't kept with the mailbox.
  5. Block sign-in on the account. A shared mailbox with an active password is an attack vector with no MFA.

A detail almost nobody checks

Shared mailboxes keep their account in Entra ID. If you don't block sign-in and they have no MFA, anyone who gets the password can walk in. It's one of the points we always review in a security audit.

]]>