MFA in Microsoft 365: why your SMB needs it and how to roll it out without locking anyone out

If your company runs on Microsoft 365 and some accounts still sign in with just a password, this article is for you. Multi-factor authentication (MFA) is the security measure with the best effort-to-benefit ratio available today, and rolling it out properly doesn't have to be painful.

What problem it solves

Passwords leak. No matter how strong they are: they show up in breaches of other services, they get reused, and a well-crafted phishing email gets them. With MFA, even if someone has the password, they also need something only the user has (usually their phone) to get in.

In practice, most of the unauthorized access we see in SMB tenants involves accounts without MFA. With MFA on, the attacker stays at the door.

The three ways to enable it

Microsoft 365 offers several routes, from least to most control:

1. Security Defaults. One switch. Requires MFA for everyone and blocks legacy authentication. Free, included in every plan. Ideal if you don't have Entra ID P1 licenses.
2. Conditional Access. Rules like "require MFA except from the office" or "block countries we never work from". Requires Entra ID P1, which is included in Microsoft 365 Business Premium and in E3/E5.
3. Per-user MFA (legacy). Still exists, but Microsoft is retiring it. Don't start here.

For most SMBs the answer is simple: if you have Business Premium, Conditional Access; if not, Security Defaults.

How to roll it out without locking anyone out

The usual fear is "tomorrow nobody will be able to sign in". A bit of order avoids it:

• Give a week's notice and explain what will happen: on sign-in, users will be asked to set up the Microsoft Authenticator app.
• Prepare admin accounts first. They matter most and get attacked most.
• Shared accounts and service mailboxes: identify them beforehand. The usual move is to convert them into shared mailboxes with sign-in disabled, not to put MFA on them.
• Printers, scanners and legacy apps that send email over SMTP don't support MFA. They need a connector or an app password, and are worth reviewing one by one.
• Keep an emergency (break-glass) account excluded from the rules, with a long password stored outside the tenant.

Methods: what to recommend

Passkeys: the next step

Microsoft is clearly pushing towards a passwordless world, and in Microsoft 365 you can already work that way today. A passkey is a FIDO2 credential that lives on the phone, the computer or a hardware key, unlocked with the device's fingerprint, face or PIN. There is no password to steal and no code to type: the user approves the sign-in on their device and that's it.

What matters for an SMB:

• It resists phishing. A passkey only works on the site it was created for. Even if a user lands on a fake Microsoft page, it cannot be used there. Not even the Authenticator app with push notifications guarantees that.
• It's already included. Entra ID supports passkeys in Microsoft Authenticator (iOS and Android) and FIDO2 security keys with no extra licensing; you enable it from the tenant's authentication methods.
• It's more convenient than MFA. One gesture on the phone replaces password + code. In practice, users welcome it more than they fear it.
• Start with admins and sensitive roles, using Conditional Access to require a "phishing-resistant authentication strength" for them. Then roll it out to everyone else.

MFA remains the mandatory first step; passkeys are the destination worth reaching over the next year.

After enabling it

MFA isn't the end. The natural next steps are blocking legacy authentication (if Security Defaults hasn't already), reviewing who holds the Global Administrator role, and enabling risky sign-in alerts. But that's another article.

If you'd like us to review your tenant before touching anything, the free audit includes exactly this check.