Why MFA is so important
A large proportion of cyber risk now centres on identity. If an attacker gains access to an email account, cloud platform or privileged admin account, the consequences can spread quickly across the rest of the organisation.
MFA adds a verification layer that makes unauthorised access much harder, even when a password has already been exposed. For many businesses, it’s one of the simplest security improvements with the highest impact.
“Account protection that doesn’t depend on passwords alone — applied everywhere it counts.”
What’s included
MFA shouldn’t be limited to a few admin accounts. We apply it across the systems that matter most, and design the policies, factors and recovery paths around it.
- Microsoft 365
- MFA and conditional access for Exchange Online, Teams, SharePoint and the wider tenant.
- Google Workspace
- 2-Step Verification enforced with sensible policies for every user.
- Password managers
- MFA protecting password vaults such as Keeper.
- Admin accounts
- Stronger, phishing-resistant factors for privileged and administrative accounts.
- Remote access
- MFA on VPNs, remote desktop and other external entry points.
- Recovery
- Sensible recovery paths so a lost phone doesn’t lock anyone out — or open a back door.
More than a switch to turn on
Although MFA is often described as a simple setting, it’s easy to implement poorly. Common issues include inconsistent coverage, insecure recovery methods, overreliance on weak factors like SMS, limited user education, and admin accounts being treated differently from the rest of the organisation.
MFA also isn’t the end of identity security. Attackers now steal session tokens and trick users into approving prompts, which is why we pair it with identity protection to catch what happens after a successful sign-in.
From review to rollout
- Step 1 · Review
- Assess current MFA coverage, gaps and weak factors across every platform.
- Step 2 · Design
- Agree factors, conditional access rules and recovery processes for each user group.
- Step 3 · Pilot
- Roll out to a small group first to iron out issues.
- Step 4 · Roll out
- Enrol staff in stages with clear guidance and helpdesk support.
- Step 5 · Enforce
- Block legacy authentication and enforce MFA everywhere it applies.
- Step 6 · Monitor
- Review sign-in activity and coverage as staff and systems change.
How EduCom IT helps with MFA
- Review
- Current MFA coverage, gaps and weak factors across all platforms.
- Configure
- Microsoft 365 conditional access, Google Workspace 2-Step Verification and per-platform policies.
- Strengthen
- Authenticator apps as the baseline, hardware keys for admins, phishing-resistant factors where it counts.
- Recover
- Recovery paths that don’t fall back to weak options.
- Adopt
- Staff onboarding and rollout planning so MFA actually sticks.
- A core control in ASD Essentials.
- Pairs with email security against business email compromise.
- Often deployed alongside Keeper for credential hygiene.
Frameworks it supports
MFA is required or recommended by every major framework. We confirm coverage during a gap review.
- ASD Essentials
- Identity, credential and access management: phishing-resistant MFA for users authenticating to systems, and disabling legacy authentication.
- CIS v8.1
- Control 6 (access control management), including MFA for externally exposed applications, remote access and administrative access.
- ISO 27001
- Annex A 8.5 (secure authentication) and 5.17 (authentication information).
- SMB1001
- Access management requirements, including MFA, at each tier.
Frequently asked questions
What is multi-factor authentication?
MFA requires more than just a password — typically a second factor like an authenticator app code, push notification, hardware key or biometric. Even if a password is leaked, the account can’t be accessed without the second factor.
Where should we apply MFA first?
Start with Microsoft 365 or Google Workspace, admin accounts, password managers, remote access, and any system holding customer or financial data. Then extend to the rest of the environment.
Is SMS-based MFA secure enough?
SMS is better than nothing, but it’s vulnerable to SIM-swap and interception. We recommend authenticator apps as the baseline and hardware keys (such as YubiKey) for admin accounts. ASD Essentials calls for phishing-resistant MFA.
What is phishing-resistant MFA?
Methods such as passkeys, Windows Hello for Business and FIDO2 hardware keys that can’t be tricked into working on a fake sign-in page, unlike codes or push approvals.
Will MFA slow down staff?
With sensible policies, no. Trusted devices, longer session lifetimes for known locations and push approvals make MFA almost invisible day-to-day. Friction is highest on first-time logins and unknown devices — which is exactly when it should be.
What about staff who lose their phone?
Strong MFA design includes recovery paths: backup factors, helpdesk-mediated resets with identity verification, and clear processes that don’t fall back to weak recovery options.
Can MFA stop business email compromise?
MFA dramatically reduces the chance of a successful credential-based attack. Combined with email security, conditional access, identity protection and user education, it closes most of the common pathways into business inboxes.