Which MFA should your business use?

Most business email accounts that get taken over are taken over with a real password. It was reused from another site, guessed, or typed into a fake sign-in page. Multi-factor authentication (MFA) stops most of that, because the password alone is no longer enough to get in.

Not all MFA is equal, though. The method you pick decides how much protection you actually get.

The three common methods, ranked

1. Passkeys and security keys - strongest

A passkey lives on your phone or computer; a security key is a small device that plugs in or taps. Either way, the sign-in is tied to the real website, so a fake sign-in page cannot collect anything useful from it. This is what security people mean by “phishing-resistant” MFA.

The trade-off is set-up. Each person needs a supported device, and you need a plan for a lost key or a replaced phone.

2. Authenticator app with number matching - the sensible default

The Microsoft Authenticator app (or a similar app) shows a prompt when someone signs in. With number matching, the person has to type the number shown on the sign-in screen into the app before it approves. That stops “MFA fatigue” attacks, where someone spams approval requests and hopes a tired staff member taps Approve.

For most small businesses on Microsoft 365, this is where to start: it is free, it works on the phones your team already carries, and it is much stronger than a text message.

3. SMS codes - last resort only

A code sent by text message is better than no MFA. But phone numbers can be stolen through a SIM swap, where an attacker convinces a phone carrier to move your number to their SIM. Codes can also be typed into a fake sign-in page just as easily as a password.

Use SMS only for the odd person who genuinely cannot use an app, and plan to move them off it.

What about staff who push back?

We used to suggest SMS for staff who resisted MFA, because it felt familiar. We no longer do. Text codes are the weakest option, and the people most likely to resist are often the ones whose accounts matter most.

What works better:

• Set it up with them, not for them. Ten minutes sitting with each person beats an email with instructions.
• Explain the “why” in one sentence. “If someone gets your password, this is what stops them reading the company’s email.”
• Cut the prompts down. Conditional access rules can reduce prompts on trusted, managed devices, so people are not approving sign-ins all day.
• Have a recovery plan. Know what happens when someone loses or replaces their phone, before it happens.

Where to start

1. Turn on MFA for every account, starting with admin accounts and anyone who handles money.
2. Make the authenticator app with number matching the default.
3. Move remaining SMS users across.
4. Look at passkeys or security keys for admins and finance staff.

The Australian Cyber Security Centre publishes plain-English guidance on MFA at cyber.gov.au and recommends phishing-resistant methods where you can use them.

Every Managed IT plan includes Security Core, which turns on multi-factor sign-in for every user.

If you are not sure which method your team is using today, book a meeting and we will check it with you.