Over the past year, security requirements from major technology providers have become increasingly focused on Multi-Factor Authentication (MFA). Microsoft has progressively introduced mandatory MFA requirements across a number of administrative platforms and services as part of its wider commitment to improving account security and reducing the risk of compromise. Microsoft's own research has shown that MFA can prevent the vast majority of account compromise attacks, making it one of the most effective security measures available to organisations today. [learn.microsoft.com], [azure.microsoft.com]
As a company that manages technology, websites and digital services on behalf of our clients, we felt it was the right time to review MFA across our own digital estate. This included not only internal business systems, but also the various online accounts, platforms and services that support our day-to-day operations.
Whilst MFA has been considered best practice for some time, recent changes across the industry highlight just how important it has become in protecting organisations from increasingly sophisticated cyber threats. [learn.microsoft.com], [azure.microsoft.com]
What is Multi-Factor Authentication?
Multi-Factor Authentication adds an extra layer of security to an account by requiring more than just a username and password.
Alongside your password, you may also need to:
- Approve a sign-in request using an authentication app
- Enter a temporary verification code
- Use a security key
- Confirm your identity using biometric authentication such as a fingerprint or facial recognition
Even if a password is exposed, stolen or guessed, MFA makes it significantly harder for an attacker to gain unauthorised access.
Why Is Microsoft Making MFA Mandatory?
Microsoft has been gradually enforcing MFA requirements across a number of its administration platforms, including Azure, Microsoft Entra, Intune and the Microsoft 365 Admin Centre. The aim is simple: passwords alone are no longer considered sufficient protection for business-critical systems. [learn.microsoft.com], [azure.microsoft.com]
Cyber criminals increasingly target user accounts rather than trying to attack networks directly. Once credentials are compromised, attackers may attempt to access email, cloud services, business data and other connected systems.
By introducing mandatory MFA requirements, Microsoft is encouraging organisations to adopt stronger security practices and reduce their exposure to these common attack methods. [learn.microsoft.com], [azure.microsoft.com]
For many businesses, including ourselves, this has acted as a useful prompt to review authentication policies across all digital services and platforms.
Looking Beyond Traditional IT Systems
When people think about cyber security, they often focus on laptops, servers, firewalls and email systems.
Whilst these remain incredibly important, businesses today depend upon a much wider range of online services.
As part of our review, we looked at access controls and authentication across:
- Microsoft 365 services
- Website administration platforms
- Social media accounts
- Cloud services
- Third-party business applications
- Hosting and domain management portals
Many organisations pay close attention to securing their primary IT systems while giving less consideration to the accounts that support their digital presence.
However, a compromised social media account can potentially damage a company's reputation, undermine customer trust, distribute malicious content or be used to impersonate the business online. Likewise, access to website administration, hosting or domain management accounts can present significant security risks if not properly protected.
Why We Undertook the Review
Partly, the review was driven by evolving security best practice and the growing adoption of mandatory MFA requirements from technology providers. [learn.microsoft.com], [azure.microsoft.com]
However, it was also about ensuring that we continue to follow the same standards and recommendations that we advise our clients to adopt.
The review involved:
- Checking account ownership
- Verifying recovery information
- Ensuring MFA was enabled wherever possible
- Reviewing legacy user access
- Confirming security settings were up to date
- Assessing critical business and digital platform accounts
In some cases, the work was straightforward. In others, it highlighted challenges familiar to many businesses, particularly where accounts have existed for many years, personnel have changed, or security settings have simply not been reviewed recently.
What We Learned
One of the biggest lessons from the exercise was just how many accounts now form part of a company's digital footprint.
It's easy to focus on email accounts whilst overlooking social media platforms, websites, cloud services and other business applications.
Effective cyber security relies on visibility and ownership. Businesses should know:
- What accounts they have
- Who owns them
- Who has access
- Whether MFA is enabled
- How access can be recovered if needed
Without this information, maintaining good security becomes increasingly difficult.
A Few Simple Recommendations
If your organisation has not reviewed its authentication policies recently, we would recommend considering the following:
Enable MFA Wherever Possible
If a platform supports MFA, enable it. It remains one of the most effective methods of protecting business accounts.
Review Critical Business Accounts
Don't just focus on email. Include websites, cloud platforms, social media, domains and other key services.
Check Recovery Information
Ensure recovery email addresses, telephone numbers and account contacts remain current.
Remove Unused Access
Old user accounts and outdated permissions can introduce unnecessary security risks.
Review Security Regularly
Cyber security should not be treated as a one-off project. Regular reviews help ensure that protections remain appropriate as systems and teams evolve.
Security Is About More Than Technology
Cyber security can often seem complex, but some of the most effective protections are also the simplest.
Multi-Factor Authentication requires very little effort from users, yet it can dramatically reduce the risk of unauthorised access to business systems and online accounts.
Our recent review was a valuable exercise and reinforced an important lesson: protecting a business today isn't simply about securing devices and networks. It's about securing every account that supports, represents or connects to the organisation.
As technology providers continue to strengthen authentication requirements, now is an ideal time for businesses to review their own security arrangements and ensure they are keeping pace with modern best practice. [learn.microsoft.com], [azure.microsoft.com]
Need Advice on Cyber Security?
Whether you're reviewing Multi-Factor Authentication, assessing account security or looking to strengthen your wider cyber security posture, the team at Qdos can help identify risks and recommend practical, business-focused solutions tailored to your organisation.
