If you run a small business and use Microsoft 365, you've probably heard that you need MFA, or multifactor authentication.

You may have even already turned it on.

But here's the problem: not all MFA is created equal.

There's a big difference between simply checking the "require MFA" box and actually building a secure Microsoft 365 environment.

The good news is that you don't need a massive IT department or an expensive security system to get started. A small business can dramatically improve its security with a few sensible decisions.

Here's what I recommend.

What Is MFA?

Multifactor authentication adds another layer of protection to your account beyond your password.

Instead of signing in with just:

Username + Password

you also prove that you have something else, such as:

• Your phone

• An authenticator app

• A security key

• A passkey

• Another approved authentication method

The idea is simple: if someone steals your password, they shouldn't automatically get your account.

And that's incredibly important when your Microsoft 365 account contains your business email, files, contacts, calendars, Teams conversations, and potentially sensitive company information.

Is Microsoft Authenticator Enough?

For many small businesses, Microsoft Authenticator is an excellent place to start.

It is significantly better than relying on passwords alone, and Microsoft supports Authenticator as part of its broader authentication ecosystem. Microsoft also recommends deploying Authenticator as a second factor while organizations move toward stronger passwordless and phishing-resistant methods.

But there's an important distinction:

Microsoft Authenticator is not the same thing as phishing-resistant authentication.

A user can still potentially be tricked into approving a malicious authentication request.

That's why I don't recommend treating "we have Microsoft Authenticator installed" as the end of your security strategy.

It's the beginning.

What About Text Messages?

SMS-based MFA is better than having no MFA at all, but it shouldn't be your long-term goal.

SMS and voice authentication are vulnerable to attacks such as SIM swapping and other forms of social engineering. Microsoft is actively moving Entra ID toward passkeys and away from Microsoft-provided SMS and voice authentication, with Microsoft-provided SMS/voice scheduled for retirement in 2027.

If your business is still using SMS for MFA, don't panic.

But start planning your transition.

What Is Phishing-Resistant MFA?

This is where things get more interesting.

Traditional MFA can stop an attacker who simply has your password.

Phishing-resistant authentication is designed to make it much harder for an attacker to trick you into giving them a usable authentication credential in the first place.

Microsoft currently recommends phishing-resistant methods such as:

• Passkeys

• FIDO2 security keys

• Windows Hello for Business

• Certificate-based authentication

These methods use cryptographic credentials rather than simply sending you a code to type or asking you to approve a notification.

For example, a FIDO2 security key can be used to authenticate without handing a reusable password or code to a phishing website.

That's a major improvement.

What Should Small Business Administrators Use?

This is where I would raise the security bar.

A normal employee account and a Microsoft 365 administrator account should not necessarily have identical security requirements.

An attacker compromising a regular employee account is bad.

An attacker compromising a Global Administrator account can potentially be catastrophic.

Microsoft specifically recommends protecting privileged accounts with phishing-resistant authentication and using Conditional Access to enforce stronger authentication requirements for those accounts.

For administrators, I'd strongly consider:

Phishing-resistant MFA → Passkey/FIDO2/security key → Conditional Access enforcement

Hardware security keys are particularly attractive for administrators because the credential is tied to the physical device.

Don't Forget Conditional Access

One of the biggest mistakes I see is treating MFA as a single setting.

In Microsoft Entra ID, Conditional Access allows you to define when and how users must authenticate.

For example, you can create policies that require stronger authentication for administrators or sensitive resources.

Microsoft provides built-in authentication strengths, including:

• Multifactor authentication

• Passwordless MFA

• Phishing-resistant MFA

These can be applied through Conditional Access policies.

That's much more powerful than simply saying:

"Everyone has MFA."

You can start asking:

Who is signing in?

What are they accessing?

Where are they signing in from?

What level of authentication should they be required to use?

That's where Microsoft 365 security starts becoming a real security strategy rather than a checkbox.

What Happens If Someone Loses Their Phone?

This is something every business should think about before it happens.

If an employee's only authentication method is their phone and that phone disappears, you need a recovery process.

That might involve:

• A second registered authentication method

• Administrator-assisted recovery

• Temporary Access Passes

• Proper account recovery procedures

Microsoft supports several account recovery mechanisms, including Temporary Access Pass and other identity verification capabilities.

The important part is to have a plan.

Don't wait until an employee is standing outside the office saying, "I lost my phone and I can't log in."

So What Does a Small Business Actually Need?

If you're a small business owner and you're wondering where to start, here's my practical recommendation.

Regular employees

Start with Microsoft Authenticator or another appropriate modern authentication method.

Then work toward stronger, phishing-resistant authentication as your business matures.

Administrators

Use phishing-resistant authentication whenever practical.

FIDO2 security keys and passkeys are excellent options.

Conditional Access

Don't stop at simply enabling MFA.

Use Conditional Access to enforce appropriate authentication requirements, especially for administrative accounts.

Recovery

Make sure employees and administrators have a legitimate way to recover their accounts if they lose their authentication device.

Review

Don't configure MFA once and forget about it.

Review your authentication methods and policies periodically.

Microsoft's current direction is clearly toward phishing-resistant authentication and passkeys rather than relying on phishable methods such as SMS.

MFA Isn't Just an IT Checkbox

The most important thing to remember is that MFA is part of your overall security strategy.

You don't need to implement every advanced security feature on day one.

For a small business, I'd rather see:

Good MFA + good backups + secure endpoints + strong passwords + sensible access controls

than an expensive collection of security products nobody understands or maintains.

Start with the basics.

Then improve them over time.

That's how you build a secure environment that your employees can actually use.

Need Help Securing Microsoft 365?

Not sure whether your business is using Microsoft 365 securely?

MooseDenIT provides straightforward Microsoft 365 administration and IT support for small businesses throughout Cypress, Waller, and Northwest Houston.

I can help with Microsoft 365 configuration, MFA, Microsoft Entra ID, Conditional Access, account security, and other everyday IT needs.

[Get IT Support] → https://moosedenit.com/business-it-support