Multi-Factor Authentication for Business

Key facts

• MFA stops the attack that most often reaches small businesses: a valid password, obtained from an unrelated breach or a phishing page, used to sign in.
• Not all MFA is equal. SMS codes are the weakest common form, app-based approval is better, and phishing-resistant methods such as passkeys and hardware keys are the strongest. Microsoft retires its own SMS and voice authentication in Entra ID on 1 February 2027.
• Coverage decides the outcome. MFA on email but not on remote access, or enabled for staff but not administrators, leaves the door it was meant to close still open.
• Conditional access is what makes MFA tolerable, applying stronger checks to risky sign-ins and staying quiet for routine ones on managed devices.
• MFA is a named requirement in most Australian cyber insurance applications and a control in the Essential Eight, so the evidence matters as much as the deployment.
• 4iT deploys MFA as a managed control, including the exceptions register, the recovery process, and the reporting an insurer or auditor will ask for.

Why is MFA the control worth doing first?

Because it defeats the most common route into a small business. The attack pattern is rarely sophisticated: credentials leak in someone else’s breach, or a convincing login page harvests them, and the same details are tried against Microsoft 365, banking and remote access. Without a second factor, a valid password is a working key. With one, the attacker has the password and still cannot get in.

It is also cheap relative to what it prevents. For most SMEs the licensing is already owned, and the work is configuration and change management rather than new spend. That combination, high impact and low cost, is why it belongs ahead of almost everything else on a security roadmap. For the plain-English explanation of how it works, see what is multi-factor authentication.

Where do MFA rollouts usually fall short?

Coverage gaps, almost every time. The common ones we find are administrator accounts left exempt because the exemption was convenient during setup and never removed, legacy authentication protocols still enabled so a sign-in can bypass the policy entirely, service and shared accounts with no second factor, and third-party systems outside the identity platform such as banking portals, accounting software and the payroll system.

The second failure is method. A deployment that satisfies the box-tick with SMS codes is materially weaker than one using app-based approval or a phishing-resistant method, because modern phishing kits relay a code in real time and SIM swapping is a genuine risk. The third is the recovery path: if a lost phone means an administrator disables MFA to get someone working, the control is optional in practice. Each of those is a specific thing to check rather than a matter of opinion.

What does 4iT do?

We start by establishing where you stand: which accounts have MFA, which methods are in use, whether legacy authentication is still open, and which systems sit outside the identity platform. That inventory is usually the first time a business sees the gaps written down. Then we design the policy set, using conditional access so the checks scale with risk instead of prompting people constantly, which is what drives the complaints that get a rollout reversed.

Deployment is staged, with administrators first, then staff by group, with the exceptions register documented and time-limited rather than permanent. We set up and test the recovery process before it is needed, register a second method per user so a lost phone is an inconvenience rather than a lockout, and close legacy authentication. After that it is ongoing: new starters are enrolled as part of onboarding, exceptions get reviewed rather than forgotten, and the reporting is kept in a form you can hand to an insurer.

MFA is one layer of identity control and works alongside identity and access management, password management and security awareness training.

How does MFA affect insurance and compliance?

It is now a standard question rather than a nice-to-have. Australian cyber insurance applications commonly ask whether MFA is enabled, on which systems, and for which accounts, and the answers affect both the premium and whether a claim is paid. Answering yes when coverage is partial is a risk in itself, because the detail gets examined after an incident rather than before.

MFA is also one of the Essential Eight mitigation strategies, so it carries weight in any assessment against that framework and in the security questionnaires larger customers send before signing. What is being asked for in practice is evidence: which accounts are covered, what methods are permitted, how exceptions are handled and who reviews them. We produce that as part of the service. See cyber insurance readiness and Essential Eight.