If you had to pick one cybersecurity control that delivers the most protection for the least cost and effort, it would be multi-factor authentication (MFA). Microsoft’s own data shows that MFA blocks more than 99.9% of automated credential attacks — and yet, a significant proportion of Australian businesses still haven’t enabled it on all their accounts. This article explains what MFA is, why it matters, and how to implement it properly for your business.
What Is Multi-Factor Authentication?
Authentication is the process of proving you are who you claim to be when logging into a system. Traditional authentication relies on a single factor — something you know (your password). Multi-factor authentication adds at least one more factor: typically something you have (your phone) or something you are (your fingerprint).
In practice, MFA for business users most commonly works like this: you enter your username and password as normal, then the system sends a notification to your phone asking you to approve the login. Even if an attacker has your password, they can’t complete the login without your phone.
Why Passwords Alone Are Not Enough
Passwords are fundamentally insecure for several reasons. People reuse them across services — meaning a breach of one site exposes all accounts using the same password. They’re phished — convincing fake login pages capture credentials without the user realising. They’re sprayed — attackers try common passwords against large numbers of accounts until they find one that works. And they’re bought — billions of username/password combinations from past breaches are available on criminal marketplaces for trivial cost.
The data is stark: the vast majority of business account compromises involve credentials that were either reused, phished, or otherwise exposed — not passwords that were “hacked” through sophisticated means. MFA addresses all of these attack vectors simultaneously.
Where to Enable MFA in Your Business
- Microsoft 365 / Azure AD — this is the highest priority. All accounts, especially administrators. Microsoft Authenticator app is free and works well.
- Google Workspace — similarly critical if you use Google’s productivity suite.
- Remote access tools — VPN, Remote Desktop, Citrix, and any other remote access method. Exposed RDP without MFA is one of the most common ransomware entry points.
- Banking and financial systems — online banking, accounting software, and any system connected to financial transactions.
- Cloud services and SaaS applications — CRM systems, project management tools, and any other cloud application that stores business or customer data.
Implementing MFA Properly
Simply enabling MFA isn’t sufficient — it needs to be configured correctly and enforced consistently. Common mistakes include enabling MFA but leaving it optional, using SMS-based MFA (which is better than nothing but vulnerable to SIM swapping), or not covering service accounts and administrator accounts. Kinsoft can audit your current MFA implementation and ensure all accounts are properly protected.
For Microsoft 365, we recommend implementing Conditional Access policies that enforce MFA based on risk signals — requiring MFA for all logins from outside your office network, all logins from new devices, and all logins by administrator accounts regardless of location.
Enabling MFA is free in most Microsoft 365 plans. Kinsoft can help you roll it out and train your staff. Get in touch to get started.