What is MFA?

Multi-factor authentication (MFA), is the ability to verify a login with at least one other verification point, beyond a single password. MFA for Office 365 is included as part of the Office 365 subscription at no additional cost.

Who should be using MFA?

Today, all users should be leveraging this security feature. In the recent past, multi-factor authentication (MFA) was only available to the most security-conscious companies. Large capital and operational costs kept this functionality within the realm of the large enterprise, which considered perimeter security essential to their business. In today’s climate of cybersecurity breaches, secure authentication practices are mandatory to avoid corporate embarrassment and hefty financial consequences. Also, the advent of the smartphone provided alternatives to the hard token smart cards. Soft tokens provided a simpler distribution method and simplified an IT or security department’s operational costs, but the supporting infrastructure, software, and integration still intimidated interested organizations. Public cloud and SaaS products existing outside of the borders of an Enterprise forced providers to meet the security requirements existing on-premise.

Why should I implement MFA?

Today, not having MFA enabled on public cloud services poses a tremendous security risk. MFA immediately reduces phishing and social engineering attacks by forcing an employee to accept and verify a login attempt. Passwords can be breached without exposing corporate data to the hacker. Secondarily, a verification request notifies the end user that something is amiss with their password, giving them the opportunity to update it and investigate how the password was compromised.

How do I implement it?

Enabling MFA in Office 365 is simple. Microsoft highly recommends enabling MFA for administrators at a minimum. Selectively enabling MFA provides organizations the opportunity to slowly roll out this essential security feature to minimize the impact on the support organization.

Logging in with a Global administrator on your tenant will bring you to the administrator portal for MFA. Once there, simply select the individual users you want to enable it for, then click enable. The next time they log in they will be prompted to set up their alternate access methods and preferred mechanism for verification.

How does it work?

When the user first logs in, they will be required to configure their alternate access method and verify it works. This alternate access method can be either a smartphone with the Microsoft Authenticator app installed, a phone number that accepts text messages, or an alternate email address. The Microsoft Authenticator app also provides a rotating number that can be used as the second factor. The image below shows an example of an ‘Approve sign in request’, on a smartphone using this app.

After verification, the user has full control over the MFA settings.

…not so fast!

Not all applications use Microsoft’s modern authentication method which supports MFA. If you aren’t using the Outlook app on your mobile phone, you will need to generate a highly complex app password to allow you to authenticate without the second factor. Microsoft recommends you create a unique app password per device so that it can be deleted in the event you lose that device. Once generated, copy the password to your clipboard – as this password will not be generated or seen again (see below). You can simply create a new password if you lose, or need to reset it. A user can manage their app passwords at this link: Click Here

Creating a new password is easy and quick. See the steps below to create an app password.

1. Create a name for your app password
2. Copy the new password to your clipboard