Your Business Uses MFA. But Is It Actually Secure?

Most businesses now use multi factor authentication (MFA) to protect their Microsoft 365 accounts. You enter your password, receive a code on your phone, and you're in.

Simple enough. But how secure is it really?

The problem is that not all MFA methods offer the same protection. And just because your business has MFA switched on doesn't necessarily mean every account is properly protected.

Why SMS authentication is becoming a problem

Receiving a six digit code by text message is still one of the most common ways to verify your identity.

It's certainly better than using a password alone, but it has its weaknesses.

One of these is SIM swapping, where a criminal tricks a mobile provider into transferring your phone number to a SIM card they control. Once they've done that, they can potentially receive your verification codes.

There's also phishing. We've all seen convincing fake Microsoft login pages. If an employee enters their password and SMS code into one of these, a criminal could use those details to access their account.

So while MFA is doing its job, the method being used can still leave the door open.

Enabled is not the same as enforced

This is something we regularly encourage businesses to check.

Having MFA enabled in Microsoft 365 doesn't automatically mean it's being enforced across every account.

Some employees might be using it, while others aren't. There could be exceptions in security policies, older authentication methods still in use or accounts that aren't covered by the expected protections.

It's easy to assume everyone is protected because MFA has been switched on at some point.

The important question is whether it's actually being enforced consistently.

What should you be using instead?

For businesses using Microsoft 365, there are several better options.

Microsoft Authenticator

Rather than receiving a text, employees approve sign ins through an app on their phone. It's a simple improvement that removes the reliance on SMS, although standard app approvals can still be vulnerable to phishing.

Passkeys and Windows Hello

These allow employees to sign in using facial recognition, a fingerprint or a device PIN.

When properly configured, they offer phishing resistant protection, meaning criminals can't simply steal a verification code and use it to access an account.

They're also often quicker and easier for employees than typing in codes.

Physical security keys

For business owners, finance teams and IT administrators, physical security keys such as YubiKeys provide particularly strong protection.

They're especially useful for accounts with access to sensitive information or important business systems.

Is your business properly protected?

If your business uses Microsoft 365, it's worth asking your IT provider a few simple questions.

1. Is MFA enforced for every employee?
2. Are we still relying on SMS verification?
3. Are our administrator accounts protected with phishing resistant MFA?
4. When were our Microsoft 365 security policies last reviewed?

You might be surprised by the answers.

A small change that can make a big difference

MFA remains one of the simplest and most effective ways to protect business accounts. But the type of MFA you use matters.

Moving away from SMS, introducing stronger authentication methods and making sure your policies are properly enforced can significantly improve your security without making things harder for employees.

At CT1 Technologies, we help businesses across Canterbury and Kent get more from Microsoft 365 while keeping their systems secure.

If you're unsure how well your business is protected, get in touch. We're always happy to take a look.