Passwords are broken. Not the technology itself, but the idea that a password alone is sufficient to protect an account. Every year, hundreds of millions of username and password combinations leak from compromised services, and attackers buy these lists and systematically test them against companies' systems. A password from a service you used three years ago can today give access to your email, if you don't have MFA enabled.

What is MFA?

MFA stands for multifactor authentication (also called two-factor authentication or 2FA). The principle is simple: to log in, it is not enough that you know something (your password). You must also prove your identity in an additional way.

Think of it as a safe deposit box that requires both a key and a PIN. If someone steals the key, they still can't get in without the PIN. The same applies to MFA: even if an attacker has your password, they cannot log in without access to the second factor.

Why are passwords alone not enough?

The problem with passwords is not just data breaches. It is also that people reuse them. Studies show that over 60% of users reuse the same password across services. This means that a leaked password from, for example, an online shop can be used to access your company's email or cloud solution.

Furthermore, phishing (which we cover in another article) is extremely effective at stealing passwords. An employee who clicks on a fake Microsoft login delivers their password to an attacker. Without MFA, the account is compromised immediately. With MFA, the attacker still lacks the second factor.

According to Microsoft, MFA blocks over 99.9% of automated account attacks. It is the single simplest and most effective security measure you can implement in your company, and it is cheap or free with most existing subscriptions.

The three types of MFA

SMS code

The most widespread form. When you log in, a one-time code is sent to your mobile phone via SMS. You enter the code as the second step. It is better than nothing, but SMS-based MFA has weaknesses: codes can be intercepted via SIM-swap attacks, and phishing sites can forward the code to the attacker in real time. For most SMBs, however, SMS-based MFA is still a significant boost to the security level.

Authenticator app

Apps such as Microsoft Authenticator or Google Authenticator generate a new six-digit code every 30 seconds directly on the phone, without an internet connection. The code is time-limited and generated locally, which makes it harder to intercept than an SMS. Microsoft Authenticator also supports number matching, where you confirm a number shown on the login screen instead of just tapping Approve. This makes it harder to approve an MFA request by mistake.

Hardware key (FIDO2)

A physical USB or NFC key (e.g., YubiKey) is the strongest form of MFA. It is immune to phishing because the key only works on the correct domain. Primarily used for administrators and high-risk users. Typically costs 300–600 DKK per key, but for critical accounts the investment is small compared to the risk.

MFA in Microsoft 365: step by step

If you have Microsoft 365 for your company, MFA is already included. Here's how to enable it:

  1. Log in to Microsoft 365 Admin Center (admin.microsoft.com) with an administrator account.
  2. Go to Identity → Overview → Security defaults and enable them. This enables MFA for all users automatically.
  3. Alternatively, and more flexibly, you can create Conditional Access policies under Microsoft Entra ID (formerly Azure AD), which lets you require MFA under specific conditions, for example, when logging in outside the office.
  4. Communicate to employees that they will be asked to set up MFA at their next login. Send a brief guide before you enable it.
  5. Set a deadline: all accounts must have MFA enabled within 14 days. Enforce it technically if necessary.

How to roll out MFA in a small company

The biggest resistance to MFA is not technical. It is human. Employees find it cumbersome, and managers worry that it slows down workflows. The truth is that MFA adds 5–10 seconds to the login process, and that is the price for eliminating one of the most likely causes of a data breach.

Practical advice for the rollout:

  • Start with administrator accounts. They are the most valuable target. Do it first.
  • Use Microsoft Authenticator instead of SMS. It is slightly more secure and provides a better user experience with notifications.
  • Create a simple guide for employees, ideally with screenshots, that shows them how to set up the app on their phone.
  • Plan support capacity. During the first two days after activation, some people will have questions. Make sure IT is available.
  • Enable MFA for email, VPN and all cloud systems. This is not just about Microsoft 365. Check which other systems your company uses.

What MFA does not solve

MFA is not a shield against everything. Sophisticated phishing attacks (so-called adversary-in-the-middle attacks) can forward both password and MFA code in real time. Therefore, MFA is best combined with other measures: updated software, secure DNS filtering, and employee training. But without MFA, you are unnecessarily vulnerable to attacks that happen thousands of times a day, and which would have taken 30 minutes to protect against.