Multi-Factor Authentication: Why Every GTA Business Needs It

Microsoft states that MFA combined with blocking legacy sign-in stops more than 99.9% of common identity-related attacks. That is Microsoft's figure for password spraying and credential stuffing, the attacks that hit small businesses most.

It does not stop everything. Attackers now use fake login pages that relay your code in real time, then steal the session token. They also send repeated push prompts until someone taps Approve. The method you choose decides how well you resist those two tricks.

Security defaults is free and is a single switch in the Microsoft Entra admin centre (Entra ID > Overview > Properties > Manage security defaults). It requires every user to register MFA, prompts when needed and blocks legacy authentication. Users get 14 days to register. Microsoft's security defaults page describes exactly what it enforces.

Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. It lets you require stronger methods for admins, block sign-ins from countries you never work in, and exempt nothing by accident. You must turn security defaults off to use it. Our guide to security defaults vs Conditional Access covers the choice in detail.

Either way, check that number matching is in effect for push notifications (users cannot opt out of it), and consider passkeys for anyone with admin rights.

In the Admin console go to Security > Authentication > 2-step verification, allow users to turn it on, give them a set enrolment period, then switch enforcement on. Google's 2-Step Verification guide explains the enrolment window and the option to allow only security keys for high-risk users. Our step-by-step is at Google Workspace 2-step verification.

This matters in the GTA. In our 5 August 2026 scan of 479 mail-enabled GTA business domains, Google Workspace domains enforced DMARC at 10.8% against 27.2% for Microsoft 365, which suggests Workspace tenants are more often left at their defaults.

MFA rollout and enforcement is part of our managed security services; see also how our managed IT plans are structured.

1. 01

   Shared mailboxes

   In Microsoft 365, a shared mailbox should have sign-in blocked; people reach it through their own MFA-protected accounts. If staff log in to a general 'info' address with a shared password, convert it to a shared mailbox first.

2. 02

   Emergency (break-glass) accounts

   Keep two cloud-only admin accounts for the day MFA or Conditional Access locks everyone out. Microsoft now recommends passkeys (FIDO2) for emergency access accounts. Store the keys in two separate secure places and alert on any sign-in.

3. 03

   Staff without a company phone

   Some employees will not put a work app on a personal phone. Give them a FIDO2 security key. It costs less than the argument and is stronger than SMS.

4. 04

   Scanners, copiers and old apps

   Devices that send mail with a username and password often rely on legacy authentication, which MFA cannot protect. Move them to a connector or app password alternative before you block legacy authentication.

5. 05

   Executives and finance staff

   These are the accounts used to redirect payments. Require phishing-resistant methods for them first, even if everyone else stays on push with number matching for now.

• Week 0: list every account, including shared and service accounts, and decide method per group.
• Week 1: create two emergency access accounts and test them.
• Week 1 to 2: announce, register users in small groups, sit with anyone who struggles.
• Week 3: enforce, then block legacy authentication.
• Week 4: review sign-in logs for failures and anything still using old protocols.
• Ongoing: check Microsoft Secure Score monthly and reset MFA only after verifying the person by a callback to a known number.

MFA added after a compromise does not remove an attacker who already has a session or an inbox rule. Follow what to do if a Microsoft 365 account is hacked, and call our 24/7 incident line at (289) 582-9930 if money or client data may be involved.