Multi-Factor Authentication for Microsoft 365: A Setup Guide for Small Businesses

Multi-factor authentication (MFA) is a sign-in check that asks for a second proof of identity, such as an approval on your phone, before anyone can open a Microsoft 365 account. It means a stolen password no longer opens the door on its own, which matters because email and file accounts hold most of what attackers want from a small business.

This post is written for New Zealand and Australian businesses with 1 to 50 staff. It covers the types of MFA, how to choose a method, how to set MFA up in Microsoft 365, and where it fits with your privacy obligations.

What Is Multi-Factor Authentication?

MFA checks that you are really you by asking for proof from more than one category. You still type your password, but you then confirm a second thing that only you should have. Some apps call this two-step verification, and you will also see it written as multifactor authentication. All of these describe the same idea.

Every method falls into one of three groups, known as factors.

• Something you know, such as a password or PIN.
• Something you have, such as a phone running an authenticator app or a security key.
• Something you are, such as a fingerprint or face scan.

Real MFA draws from at least two groups, so a password plus a PIN does not count because both are things you know. The Australian Signals Directorate makes a similar point in its guidance on multi-factor authentication, where it explains that multi-step sign-in is not a suitable substitute for true MFA.

What Is the Difference Between 2FA and MFA?

Two-factor authentication (2FA) uses exactly two factors, while MFA uses two or more, so 2FA is one type of MFA. For most small businesses, the terms are interchangeable. What matters is that a second check exists on every account that holds business data.

Why Small Businesses Need MFA on Microsoft 365

Most account takeovers start with a password that was phished, reused or leaked, and a mailbox is a valuable prize. Once inside, an attacker can read supplier conversations, create forwarding rules and ask for changed bank details, which is how business email compromise works. MFA breaks that chain at the first step, because the attacker has your password but not your phone.

Microsoft says MFA can block over 99.2% of identity-based attacks, which is why security defaults are switched on for every new Microsoft 365 tenant. The National Cyber Security Centre in New Zealand also recommends MFA for sensitive accounts, and its MFA and verification advice pairs it with a manual check, such as phoning a supplier before changing bank details.

Which MFA Method Should You Choose?

Not every second check protects equally. The methods below run from strongest to weakest for a Microsoft 365 business account.

Fingerprints and face scans are not a separate method in this list. They unlock the authenticator app or passkey on your device, which keeps the second check quick. NCSC New Zealand advises choosing a security key or an authentication app over text and email codes where you can, although any second check is better than none.

Microsoft Authenticator or Google Authenticator?

Both apps are free and run on Android and iOS. For Microsoft 365, choose Microsoft Authenticator, because security defaults register users with that app and it approves sign-ins by asking you to match a number shown on screen. Google Authenticator suits other websites, and its codes sync through your Google account, which helps if you lose a phone but means that account needs strong protection too.

How to Set Up MFA in Microsoft 365

Turn on MFA in Microsoft 365 with security defaults or Conditional Access, register your team in Microsoft Authenticator, and confirm every account is covered.

Choose Between Security Defaults and Conditional Access

Security defaults are the simplest route and cost nothing, because they come with every Microsoft 365 plan through Microsoft Entra ID Free. Tenants created on or after 22 October 2019 may already have them switched on, so check before you start. Conditional Access gives finer control, such as blocking sign-ins from unexpected countries, but it needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. You use one or the other, and legacy per-user MFA must be turned off first. If you are not using Conditional Access, Microsoft recommends security defaults.

Roll Out MFA in Seven Steps

You need an administrator account to do this. Microsoft’s own setup instructions for MFA in Microsoft 365 are worth keeping open alongside these steps, because menu names change.

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) as an administrator.
2. Check that no admin account or older tool still relies on legacy sign-in methods, because security defaults block them.
3. Go to Entra ID, then Overview, then Properties, and select Manage security defaults, set it to Enabled and save. If you have Business Premium, create a Conditional Access policy that requires MFA for all users instead.
4. Tell your team what is coming and when. A short note describing what the prompt looks like saves most support questions.
5. Ask each person to go to myprofile.microsoft.com, open Security info and add Microsoft Authenticator. With security defaults on, users are asked to register at sign-in, and Microsoft removed the old 14-day registration grace period in July 2024.
6. Have everyone approve a test sign-in by typing the number shown on the screen into the app.
7. Open the user registration details report under Authentication methods in the Entra admin center, and chase anyone who has not registered.

Close the Gaps That Let Attackers Walk Around MFA

Legacy protocols such as IMAP, POP and SMTP basic authentication cannot ask for a second factor, so an account that still allows them stays exposed even with MFA on. Security defaults block legacy authentication, and Conditional Access has a template that does the same. Before you block it, check the sign-in logs for older scanners, scripts and apps that depend on it, since those will stop working.

If you use Conditional Access, keep one or two emergency admin accounts excluded so a policy mistake cannot lock everyone out, and store their credentials securely offline. Shared mailboxes should be accessed through delegation rather than direct sign-in, and any service account that cannot support MFA needs a documented plan.

How to Check That MFA Is On

Administrators can use the registration report described above to see who has registered and which method each person uses. Individual users can open Security info at myprofile.microsoft.com to see their own methods. A sign-in prompt for an approval or code is a good sign, but it does not prove every account is covered, so review the report for gaps rather than relying on prompts alone.

How Attackers Get Around MFA and How to Stop Them

MFA is not a guarantee, and knowing its limits helps you choose well. In an MFA fatigue attack, the criminal already has your password and floods your phone with approval requests until someone taps Approve to make them stop. Microsoft responded by enforcing number matching in Authenticator from May 2023, so users must enter a number shown on the sign-in screen, which makes blind approvals much harder. Another route is adversary-in-the-middle phishing, where a fake sign-in page captures the session after the victim completes MFA. Passkeys and security keys resist this because they only work on the genuine site.

Staff are the other half of the defence. They should know that an approval request they did not trigger means someone has their password, so they should deny it and report it straight away. Security awareness training can rehearse exactly this with realistic simulations. On the technical side, managed detection and response watches for the unusual sign-ins that follow a stolen credential, and CyberMark monitors email and cloud platforms such as Microsoft 365 as part of that service.

How Does MFA Support NZ and Australian Compliance?

The New Zealand Privacy Act 2020 does not mention MFA by name. It does require reasonable security safeguards for personal information under Information Privacy Principle 5, and MFA on email and file accounts is one of the clearest ways to show you have taken that step. If a breach causes serious harm, or is likely to, you must notify the Office of the Privacy Commissioner, and failing to do so is an offence with a fine of up to $10,000. The Commissioner’s NotifyUs self-assessment helps you work out whether a breach is notifiable.

For clients in Australia, MFA is one of the Essential Eight mitigation strategies from the Australian Signals Directorate, and the Australia Privacy Act 1988 requires reasonable steps to protect personal information. MFA also leaves a record of every sign-in, which is useful evidence for auditors, and it is worth checking your cyber insurance questionnaire because MFA is a common question. A cybersecurity risk assessment reviews access control, including whether MFA covers every account that matters, and CyberMark can help you act on the findings.

MFA Best Practices for Small Businesses

• Start with administrators and finance staff, because one stolen admin login does the most damage.
• Add MFA registration to your onboarding checklist, and remove devices when someone leaves.
• Register a second method so a lost or replaced phone does not lock someone out.
• Re-check registration after a phone upgrade or a password reset.
• Apply one policy to everyone rather than configuring people by hand.
• If you still run on-premises Active Directory, sync those accounts to Entra ID so the same rules apply, and list any older systems that cannot support MFA for replacement.

Which MFA Method Is Right for Your Business?

For most small businesses, the answer is Microsoft Authenticator with number matching for everyone, plus security keys or passkeys for administrators and anyone who approves payments. Switch on security defaults today if you are on a basic plan, look at Conditional Access if you have Business Premium, and keep SMS as a last resort.

If you would rather have someone check where MFA is missing and close the gaps, you can book a free security assessment with the CyberMark team.

Multi-Factor Authentication FAQs

Does Microsoft require MFA?

For admins, yes. Microsoft requires MFA to sign in to the Azure, Entra, Intune and Microsoft 365 admin portals, while regular users are covered by security defaults or your own policy.

Will MFA slow my staff down?

Not noticeably. Approving a sign-in takes a few seconds, and people are usually prompted at sign-in or on a new device rather than for every file or email.

What happens if an employee loses their phone?

An administrator can remove the old device, revoke the person’s active sessions and have them register a new one. A second registered method makes this faster.

Do I need MFA for every employee?

Yes, for every account that can sign in to Microsoft 365. Attackers go after the weakest login rather than the most senior one, so include part-time and contractor accounts.

Is a VPN multi-factor authentication?

No. A VPN encrypts your traffic but does not prove who you are, although you can require MFA when people sign in to it.

Is Google Authenticator better than 2FA?

They are not alternatives. Google Authenticator is an app, and 2FA is the method, so the app is one way to do 2FA.