Still doubting whether to turn on MFA (multi-factor authentication) for your organization? You're late, but not too late. A password alone no longer protects a Microsoft 365 account, and customers, insurers and Microsoft itself expect you to use a second step. Below are the three main reasons, which method to choose and how to roll out MFA without overwhelming your helpdesk.
Three reasons
1. Passwords get stolen
Through phishing, leaked databases or simple guessing. Many people reuse the same password across sites, so a breach at a web shop can open their work account. With MFA, a stolen password alone isn't enough to get in. According to Microsoft, MFA blocks more than 99 percent of account attacks. For the basics, see what is Multi-Factor Authentication.
2. One account opens everything
Your Microsoft 365 account gets you into email, OneDrive, SharePoint, Teams and often other apps through single sign-on. One hacked account can do a lot of damage: fake invoices or changed bank details sent from your mailbox, forwarding rules that silently copy everything, or shared files that disappear. And with an admin account, your whole tenant is wide open.
3. It's expected, and sometimes required
- Microsoft requires MFA for the Azure portal, the Microsoft Entra admin center, the Intune admin center and the Microsoft 365 admin center. Since October 2025, Azure CLI, Azure PowerShell and other management tools are following step by step for any changes you make with them.
- NIS2 explicitly lists multi-factor authentication among the measures in-scope organizations must take. In Belgium the NIS2 law has applied since October 2024.
- Insurers and customers increasingly ask about MFA in cyber insurance and supplier questionnaires. Without it you pay more or don't get covered.
Which method should you choose?
- Microsoft Authenticator with number matching: the default choice for most users. You type the number from the screen into the app, which makes blind approvals harder.
- Passkeys (in Authenticator or on a FIDO2 key) and Windows Hello for Business: phishing-resistant, because they don't work on a fake sign-in page. Ideal for admins and a step towards passwordless sign-in.
- SMS or phone call: better than nothing, but the weakest option. Use it only as a backup.
How to roll it out
- Choose your approach: security defaults are free and suit small organizations. With Conditional Access (Microsoft Entra ID P1, included in Business Premium and E3, among others) you decide when MFA is needed, for example not on a managed device in the office.
- Start with admins and create two emergency (break-glass) accounts with a strong, phishing-resistant method.
- Communicate beforehand: why, when, plus a short guide with screenshots.
- Have users register at mysignins.microsoft.com/security-info, preferably with two methods.
- Roll out per group, starting with a pilot, and keep an eye on the sign-in logs in the Microsoft Entra admin center. The detailed steps are in enable MFA in Microsoft 365.
Common problems
- Old apps and scripts that only support a username and password stop working. Replace them or move to a workload identity.
- New phone: someone who replaces their phone without moving Authenticator locks themselves out. A second method or a Temporary Access Pass solves that.
- MFA fatigue: attackers send dozens of prompts hoping someone taps Approve. Number matching and the rule "never approve what you didn't start yourself" help.
FAQ
Does MFA cost extra?
No. Security defaults and Microsoft Authenticator are free. Only Conditional Access requires a license with Microsoft Entra ID P1.
Do I have to enter a code every time?
No. After a successful sign-in, Microsoft 365 doesn't ask for MFA on every click. With Conditional Access you set how often that happens.
Is MFA enough?
It's the single most important step, but combine it with updates, limited admin rights and security-aware users.
Nederlandstalige versie: 3 redenen om MFA te activeren in Microsoft 365