An attacker doesn't need to break in if they can simply log in. And this happens more often than you think. A phishing email, a leaked password, or a colleague who uses the same password everywhere. That's all it takes.
That's why this is the most important security measure for any Microsoft 365 environment: multifactor authentication (MFA), smartly deployed with conditional access.
What is MFA?
With MFA, you prove your identity in two ways. Something you know, like a password. And something you have, like your phone. A stolen password alone isn't enough.
Microsoft is now enforcing MFA itself for logging into its management portals. For your regular users, you have to set it up yourself.
Not all MFA is equally strong
- SMS and voice call: better than nothing, but vulnerable.
- Microsoft Authenticator with number matching: a good standard.
- Phishing-resistant methods: such as passkeys and Windows Hello for Business. The strongest option, especially for administrators.
What is conditional access?
With conditional access in Microsoft Entra, you determine under what conditions someone can log in. You define rules like:
- Always MFA for administrators.
- MFA if someone logs in from outside the office network.
- Access only from managed and secure devices.
- Block logins from countries where you are not active.
- Completely block outdated login methods that don't support MFA.
You need Entra ID P1 for this. It's included in Business Premium, E3, and E5.
Security standards or conditional access?
Don't have Entra ID P1? Then at least enable the security standards. This is a fixed set of basic settings, including MFA for everyone. Simple, but without customization.
If you do have P1, conditional access offers more control and less hassle for users.
Implementing without chaos
- Start with administrators. The risk is greatest there.
- Use the report mode. First, see what a rule would do without blocking anyone.
- Keep an emergency account handy. This way you never lock yourself out.
- Communicate in advance. Tell employees what will change and why.
- Roll out in stages. Per department, with a dedicated contact for questions.
Security is not a project, but a habit
A good setup is step one. Then you need to monitor what's happening: suspicious login attempts, new apps, and employees leaving. With Management & Support from 365 Angels, we keep that in order together with you.
Want to know how secure your Microsoft 365 login really is? Schedule a conversation and we'll do a quick check together.
Frequently Asked Questions
Is MFA annoying for employees?
With conditional access, it doesn't have to be. You only ask for MFA when the risk warrants it.
What if an employee loses their phone?
Ensure a second method and a clear procedure at your service desk.
Can I exempt users at trusted locations?
You can, but be cautious. Hybrid work makes "the office network" less meaningful. It's better to trust the device than the location.
