A shared document arrives by email just before a meeting. An employee clicks the link, sees what looks like a Microsoft sign-in page and enters their password. The page is convincing, but it belongs to someone trying to get into your business account. That account may hold customer conversations, internal files and access to other services.
Multi-factor authentication, usually called MFA, adds another proof of identity when someone signs in. It makes a stolen password less useful, but the method you choose matters. For a small business without internal IT staff, effective protection combines sensible sign-in rules, stronger authentication and clear instructions employees can follow when something looks wrong.
Why a strong password still needs backup
A unique, hard-to-guess password is valuable wherever a password is used. It does not solve every problem, though. An employee can unknowingly type a strong password into a fraudulent website, handing it directly to the attacker.
Passwords commonly become a problem in three ways:
- Reuse: a password exposed through another website is tried against the employee’s work account.
- Phishing: an email or message sends someone to a fake sign-in page that collects their credentials.
- Password spraying: an attacker tries a few common passwords across many accounts, rather than repeatedly guessing against one person.
A password manager helps employees create and store different passwords for different services. MFA adds a separate obstacle: someone who knows the password generally still needs another proof of identity. Leaving occasional users or older accounts outside that protection can leave an avoidable opening.
Choose the method, not just the MFA label
MFA uses evidence from different categories, such as something you know and something you possess. Passwordless methods can combine possession of a device with unlocking it through a PIN or biometric check. Employees do not always need to type a password for a sign-in to have strong protection.
The main options fall into three levels:
- Text messages and voice calls: better than a password alone, but the weakest options listed here. Someone can trick an employee into revealing a code, and phone numbers can be taken over.
- Microsoft Authenticator with number matching: the employee enters the number shown during sign-in into the app. Microsoft has enforced number matching for push approval notifications, helping prevent casual or accidental approvals.
- Phishing-resistant methods: passkeys, including passkeys in Microsoft Authenticator, FIDO2 security keys and Windows Hello for Business provide stronger protection when properly deployed.
A FIDO2 security key is a physical device used to prove your identity. Windows Hello for Business provides authentication tied to a device configured by the organization. An Authenticator push notification is different from a passkey stored in Authenticator. Using the same app does not mean the two methods offer the same resistance to phishing.
How phishing can get past some MFA methods
Some phishing sites do more than collect a password. They act as a middleman between the employee and the real Microsoft service, passing the sign-in details and MFA response along as the employee enters them. This is called an adversary-in-the-middle, or AiTM, attack.
After a successful sign-in, the service gives the browser a session token: temporary proof that the user has already authenticated. The malicious middleman can steal that proof and attempt to reuse it. This is why text codes and number matching do not necessarily stop these attacks, even when the employee completes MFA.
Phishing-resistant authentication binds the sign-in proof to the legitimate service. A lookalike website cannot obtain a valid proof for Microsoft in the same way. That defeats the authentication relay used by these phishing pages. It does not make an infected computer safe, so device protection remains part of the overall approach.
Give employees a clear response to suspicious activity
MFA fatigue happens when an attacker sends repeated approval requests, hoping someone will accept one out of frustration or distraction. Number matching helps, but the essential rule remains: never approve a sign-in you did not start.
Decline unexpected requests and contact your IT provider using a familiar phone number or support channel. Do not share an authentication code with someone who calls claiming to be technical support. A caller’s confidence or knowledge of your workplace does not prove their identity.
For email, teach a few checks employees can use without technical expertise:
- Look at the full sender address, rather than relying on the display name.
- Check where a link leads before entering a password.
- Consider the context: were you expecting that document or request?
Use Outlook’s phishing reporting feature if it is available and configured, then follow your company’s procedure for notifying support. Make sure everyone knows that procedure before an incident. If someone entered a password or approved a request, they should say so immediately. Support may need to revoke sessions and investigate the account. Our article on email security in 2026 covers related email habits.
Set appropriate Microsoft 365 sign-in rules
Microsoft’s Security defaults provide a basic protection package, including MFA registration requirements and blocking older authentication methods. They can suit a straightforward environment, but offer limited customization.
Conditional Access lets your provider set rules based on the user, device or circumstances of a sign-in. It requires Microsoft Entra ID P1 for covered users, which is included in Microsoft 365 Business Premium. Security defaults and Conditional Access are distinct configuration approaches to assess with your provider.
Useful policies to consider include:
- Require MFA for all users.
- Block legacy authentication: older sign-in methods that cannot support modern protections.
- Apply stronger requirements to administrators, including phishing-resistant authentication.
- Require devices to meet the security standards your business has defined.
- Block sign-ins from countries where you do not operate, when that fits your business needs.
Requiring compliant devices also means setting up device management and defining what compliance means. Geographic restrictions need care around employee travel, and attackers can disguise their location. Treat them as an additional barrier. Assess the impact of each policy before enforcement so legitimate work can continue.
Keep a secure emergency route into administration
A lost device or an incorrect access rule should not leave the business unable to manage its own environment. An emergency administrator account, often called a break-glass account, provides a way to recover access when normal administrative sign-in fails.
This account should be reserved for emergencies. Protect its authentication methods, document how authorized people can access them and set an alert for any use. Test the recovery process periodically. An account nobody can actually use during an outage does not provide a dependable recovery route.
Microsoft is enforcing mandatory MFA for sign-in to its administration portals. An emergency account should therefore not be designed around simply avoiding MFA. Your provider should arrange strong authentication that does not depend on the usual administrator’s setup, and carefully define any necessary exceptions to Conditional Access policies.
Roll it out in a manageable order
Start by explaining what will change and showing employees a legitimate sign-in request. Tell them where to get help. Plan for people without a work cellphone, shared computers and lost authentication devices before making the new rules mandatory.
- Review the accounts and applications: identify administrators, regular users and anything still relying on older sign-in methods.
- Register authentication methods: help employees complete setup and establish a secure recovery option.
- Start with administrators and finance: confirm that daily tasks work and resolve problems before expanding.
- Include everyone: enforce the agreed policies and remove temporary exceptions when they are no longer needed.
- Review over time: revisit access when people leave, devices change or regular IT reviews take place.
Account protection works best when employees understand both the normal process and what to do when something is wrong. Stronger authentication, consistent access rules and prompt reporting make a practical combination for a small business.
To discuss your Microsoft 365 environment, explore Evolute I.T.’s managed IT services or contact us about your team’s needs.
