Question 1

What is multi-factor authentication (MFA)?

Accepted Answer

Multi-factor authentication is a security mechanism that requires users to provide two or more forms of verification to access an account. After entering a password, the user provides a second factor — typically a code from an authenticator app, a push notification, or a biometric scan. MFA blocks 99.9% of identity-based attacks because even if an attacker has the password, they can't provide the second factor.

Question 2

Why is MFA so important?

Accepted Answer

MFA blocks 99.9% of identity-based attacks. Passwords alone are no longer sufficient — they can be stolen, guessed, or phished. MFA adds a second layer of security that makes it extremely difficult for attackers to access accounts even if they have the password. It's the single most effective security control for protecting against unauthorised access.

Question 3

Is MFA free with Microsoft 365?

Accepted Answer

Yes. MFA is free with Microsoft 365 security defaults, which require MFA for all users. For more granular control (conditional access policies), you need Entra ID P1, which is included with Microsoft 365 Business Premium or costs approximately £5.30 per user per month as a standalone add-on.

Question 4

What is the best MFA method?

Accepted Answer

Authenticator apps (Microsoft Authenticator, Google Authenticator) are the best balance of security and usability for most users. SMS is less secure due to SIM swapping attacks. Hardware tokens (YubiKey) provide the highest security and are recommended for high-privilege accounts like administrators. Biometric authentication (Windows Hello, Touch ID) is convenient and secure when available.

Question 5

What is conditional access?

Accepted Answer

Conditional access is a policy-based access control that evaluates each sign-in attempt based on conditions like user, device, location, and risk. For example, you can require MFA when accessing from outside the office, or block access from non-compliant devices. Conditional access reduces user friction by only requiring MFA when needed. It requires Entra ID P1 licensing.

Question 6

Can MFA prevent phishing?

Accepted Answer

MFA significantly reduces the risk of phishing. Even if a user enters their password on a phishing site, the attacker can't complete the MFA challenge without the second factor. However, sophisticated phishing attacks can bypass MFA using techniques like MFA fatigue (sending repeated push notifications) or adversary-in-the-middle attacks. We recommend combining MFA with security awareness training and advanced phishing protection.

Question 7

What is MFA fatigue?

Accepted Answer

MFA fatigue (or MFA bombing) is an attack where the attacker sends repeated MFA push notifications to a user's phone, hoping the user will eventually approve one out of frustration or habit. We mitigate this by configuring number-matching (the user must match a number shown on screen), training users to reject unexpected prompts, and monitoring for repeated MFA attempts.

Question 8

Should we use hardware tokens?

Accepted Answer

Hardware tokens (YubiKey) provide the highest level of MFA security and are recommended for high-privilege accounts like administrators, financial controllers, and anyone with access to sensitive data. They cost approximately £40–£60 per token and are immune to phishing, SIM swapping, and MFA fatigue attacks. For most users, authenticator apps provide sufficient security.

Question 9

Can you help us implement MFA?

Accepted Answer

Yes. We handle the full deployment — design, configuration, user enrollment, training, and ongoing management. We start with security defaults or conditional access policies, enroll users in MFA, provide training, and monitor for issues. Most businesses can have MFA fully deployed within 1–2 weeks.

Question 10

How do you handle users who lose their phone?

Accepted Answer

We implement fallback authentication methods — backup codes, alternate phone numbers, or email verification — so users can regain access if they lose their primary MFA device. We also provide a helpdesk process for verifying user identity and resetting MFA. It's important to have this process defined before deploying MFA.

Question 11

Does MFA affect user experience?

Accepted Answer

MFA adds a small amount of friction to the sign-in process, but with conditional access, this can be minimised — MFA is only required when accessing from new locations or devices. Most users find MFA acceptable, especially when using authenticator apps with push notifications. We provide training to ensure a smooth user experience.

Question 12

Is MFA required for compliance?

Accepted Answer

Yes. MFA is required by Cyber Essentials, Cyber Essentials Plus, and most security frameworks. GDPR doesn't explicitly require MFA, but it's considered a necessary control for protecting personal data. FCA, PCI DSS, and ISO 27001 all require MFA for certain systems and users. Most cyber insurance policies also require MFA.

Multi-Factor Authentication (MFA)

Understanding Multi-Factor Authentication (MFA)

The business impact

Who needs this?

Who doesn't need this?

The technical overview

Related technologies

What affects the cost?

Expert recommendations

Industries that benefit

Need help with multi-factor authentication (mfa)?