Why a password alone is no longer sufficient and how to set up MFA without hindering workflow

The password remains the first, and often the only, barrier between an attacker and a corporate mailbox. The problem is that passwords are no longer secrets known only to the user. Billions of leaked email and password combinations circulate freely on the internet, and it takes only one employee using the same password elsewhere. A password alone has long ceased to be reliable protection; it is more like the first hurdle that an attacker can usually clear without difficulty.

Why a password alone is not enough

The most common ways passwords end up in the wrong hands have nothing to do with "weak passwords". A phishing page that faithfully copies Microsoft's login screen will steal the password even if it is fifteen characters long with special symbols. A leak from a completely different service where an employee used the same password gives attackers the key to the corporate account too. And automated testing of leaked combinations (so-called credential stuffing) runs on a large scale regardless of how strong a specific password is. The second factor, something the user has or is, not just what they know, dramatically reduces this risk.

How MFA in M365 works in practice

Microsoft 365 primarily uses the Microsoft Authenticator app, after entering the password, a confirmation request arrives on the phone; in the more secure variant, a number is displayed that must be selected on the screen. This prevents situations where an attacker attempts to log in and hopes the user will automatically approve the push notification. Several additional levels are worth mentioning:

• SMS code: better than nothing, but can be bypassed by number forwarding, so only as a backup method.
• Push authenticator with number verification: a good balance of security and convenience for everyday users.
• Hardware key or passwordless login (passkey): the strongest option for administrators, company management and accounting.

Free protection versus full inspection

Microsoft offers a basic level of protection free in every tenant, so-called Security Defaults, which means enforced MFA for all users with no option for finer tuning. For a small company with just a few people, this may suffice as a first step. However, once you want to differentiate based on risk, different rules for the office, different ones for travel abroad, and others for administrators. You need conditional access, which is part of higher Entra ID tiers and provides far more options to configure rules precisely according to your company's needs.

Conditional access: in plain English

Conditional Access is a layer of rules on top of MFA that asks a simple question: under what circumstances should this login be trusted more and under what less? In practice, this means rules such as: if someone logs in from a known company laptop in Prague, allow them to proceed normally. If the same account attempts to log in a few minutes later from an unknown device in another country, require additional verification, or block access immediately. Conditional Access can also enforce that access to company email from a mobile device is only possible via a managed application, not through any arbitrary email client, and that risky logins automatically trigger a password change.

Settings that do not inconvenience people

The most common reason companies delay MFA implementation is concern over user resistance. In practice, this can be managed: roll it out gradually by groups, not to everyone at once. Create one or two backup ("break-glass") accounts outside standard rules in case the configuration locks out administrators. Set "remember this device" for a reasonable period so users do not have to confirm logins repeatedly, and prepare a clear procedure for lost phones so no one is locked out of the system for a day. Above all, explain why, not just what. People who understand the risk will accept annoying verification more readily.

Where to start

If you do not yet have MFA and conditional access, start with administrator accounts and remote access: the damage from compromise is greatest there. Next comes email and general M365 access, then other cloud applications. Companies that have this in place usually also address who actually needs what within the environment, for example through regular licensing and access checks, or by having a clearly defined procedure for employee departure.

We are happy to show you what conditional access looks like in your specific environment and where it makes sense to start.