Multi-Factor Authentication (MFA) in Microsoft 365 adds an extra layer of security to the sign-in process by requiring users to provide two or more verification methods. These methods typically include something the user knows (like a password) and something the user has (like a mobile device) or something the user is (like a fingerprint).
It is recommended that all Australian businesses use a second form of authentication as extra security for all software, including in this case Microsoft Office to ensure they protect personal accounts from cyber attacks and data breaches. Compromised accounts accounted for many of the Malware and Ransomware attacks and Microsoft multi-factor authentication is one of the easiest ways to mitigate and ensure individual users account security.
Microsoft 365 MFA can be used on all the Microsoft products including Microsoft Entra or Microsoft Azure Active Directory and can be established as a single sign-on SSO thereby providing you access to your compete Microsoft platform witha one-time password and one set of additional verification information.
How does Microsoft MFA or 2FA Work?
Setup Process of Microsoft 365 MFA
Administrators enable MFA for users through the Microsoft 365 admin centre. Users are then prompted to set up their additional verification methods, which can include the Microsoft Authenticator app, text message – SMS, or phone calls. Check out our How to setup Microsoft’s 365 MFA for a detailed description.
The Microsoft 365 Sign-In Process
- User enters standard Credentials : Users sign in with their username and password combination as they would normally.
- Second Verification or Two-Step Verification: After verifying user credentials, the system triggers a second verification method. This typically involves prompting the user for a verification code, approval, or token. This second factor could be done through an Authenticator app code, SMS messages, app approval, code dongle, or a phone call to a designated phone number.
- Verification Completion: The second verification for user accounts is typically time based and when users successfully complete the second step by entering the code or responding to the phone call, access to Microsoft 365 is granted
The default method is the Microsoft Authenticator app, but users can choose many other methods if preferred.
Of course you may then need to complete an additional verification method depending on the application, authorisation level and security especially for secure online accounts or manipulating contact details on secure portals within your web browser. These then truly becomes multi factor authentication.
Some organisations configure the system whereby users only need to complete the second verification step the first time they sign into their Microsoft account on a new device or app, or after changing their password. This minimizes disruption while maintaining a security level appropriate for these businesses. For applications that do not support Microsoft MFA, PIP provides other Two Factor Authentication systems that can be integrated into those applications.
What are some of the methods we use for Two Factor Authorization
Many are familiar with the primary methods for implementing two-factor authentication. However, traditional methods may not always be suitable due to factors such as multiple users sharing one account or limitations on access to personal devices and phones. Listed below are various methods used for second or multiple factors of authentication. Please note that Microsoft 365 may not offer all these methods.
- SMS Verification: A one-time code (typically a 6-digit code) is sent via text message to the user’s registered mobile number. The user must enter this code to complete the authentication process.
- Authenticator Apps: Apps like the Free Microsoft Authenticator App or Google Authenticator generate time-based one-time passwords (TOTP) that the user must enter. These codes refresh every 30 seconds and can be installed on your mobile phone. Ensure app passwords are always strong and frequently changed.
- Push Notifications: A push notification is sent to the user’s mobile device via a mobile app, prompting them to approve or deny the login attempt. This method is convenient and quick.
- Email Verification: A one-time code is sent to the user’s registered email address. All Email accounts must be registered. The user must enter this code to verify their identity.
- Hardware Tokens: Physical devices, such as key fobs or USB tokens, generate one-time codes that the user must enter. These are often used in high-security environments, such as banking.
- Biometric Verification: Methods like fingerprint scanning, facial recognition, or voice recognition are used to verify the user’s identity. These are highly secure and user-friendly.
- Security Questions: Users answer pre-set security questions. While not as secure as other methods, they provide an additional layer of verification.
- Smart Cards: Physical cards with embedded chips are used in conjunction with a PIN to authenticate the user. These are commonly used in corporate environments.
How Microsoft 365 MFA Secures Your Business
Microsoft 365 secures your business by integrating advanced security features that protect against a wide range of cyber threats. It includes multi-factor authentication (MFA) to ensure that only authorized users can access sensitive information, and uses advanced threat protection (ATP) to safeguard against phishing, malware, ransomware attacks and brute force attacks. Additionally, Microsoft 365 employs data loss prevention (DLP) policies to prevent the accidental sharing of sensitive data, and provides robust encryption to protect data both at rest and in transit. These comprehensive security measures help ensure that your business data remains secure and compliant with industry regulations. Here’s how it secures your business:
- Reduced Risk of Credential Theft: Even if a malicious actor obtains a user’s password, they would still need the second form of verification to access the account or reset the password. This greatly reduces the risk of unauthorized access due to stolen or compromised passwords
- Protection Against Phishing: MFA helps protect against phishing attacks, where attackers trick users into revealing their passwords. With MFA, knowing the password alone is not enough to gain access.
- Compliance and Security Policies: MFA helps businesses comply with various security standards and regulations by providing an additional layer of security. It also integrates with Conditional Access policies, allowing businesses to enforce MFA based on specific conditions, such as user location or device.
Compliance with Australian Cyber Security Requirements
In Australia, the Australian Cyber Security Centre (ACSC) has outlined the Essential Eight Maturity Model, which includes the use of MFA as a key mitigation strategy. Microsoft 365’s MFA capabilities align well with these requirements:
- ASD Essential Eight Compliance: The ACSC’s Essential Eight guidelines recommend using MFA to protect access to sensitive data and systems. Microsoft 365’s MFA supports this by requiring multiple forms of verification for access, thus meeting the Essential Eight’s maturity level requirements
- Implementation Flexibility: Microsoft 365 allows businesses to implement MFA using various methods, such as the Microsoft Authenticator app, SMS, and phone calls. This flexibility helps businesses meet the specific requirements of the Essential Eight while accommodating different user preferences and scenarios
- Security Defaults and Conditional Access: Microsoft 365 provides security defaults that enable MFA for all users, as well as Conditional Access policies that allow businesses to enforce MFA based on specific conditions. This ensures that MFA is consistently applied across the organization, enhancing overall security
By integrating MFA into Microsoft 365, businesses can significantly enhance their security posture, comply with Australian cybersecurity requirements, and protect their sensitive data from unauthorized access. MFA ensures that only authorized users can access Office 365 accounts, adding a layer of security by requiring a password and a secondary verification method.
Of course if you need any assistance with configuring, using or implementing Microsoft 365 MFA please contact your trusted Microsoft 365 Partner, PIP.
