What is Multi-Factor Authentication for Office 365?

With much of our daily lives based online, it is easy to forget that we tend to leave much of it accessible to hackers. If they can access one password, they can get access to several more. When it comes to work and protecting a business, multi-factor authentication (MFA) is now more important than ever.

If someone can guess one password or find a weak security link in part of your software, this need not be the be-all and end-all to them gaining access to everything else you need to protect, and it can also be introduced for Office 365 to keep everything confidential and secure.

Most security problems are caused by negligence, a lack of care in securing information, and keeping passwords obvious to guess. However, by taking the following steps, you can help to guard against it.

Why is MFA important?

The idea behind MFA is simple and acknowledges that there is only so far a good password can take you. As its name suggests, MFA combines more than one method to identify users when they try to access a site or app. These extra layers of protection are vital to keep your data safe against the more advanced hacking mechanisms that are used these days.

MFA tends to come in the shape of extra verification, and the idea that you are who you say you are needs to be backed up with more than a password. Generally, it authenticates with; something the user knows (such as a password), something they have (like a trusted device) and/or something they are (such as biometrics and fingerprints).

While facial recognition software has become one of the exciting new ways to keep smart mobile devices safe, being implemented across big organisations and on bigger devices not built for such technology makes it impractical. There are other ways to do this, which are less costly to install, and need nothing more than existing systems.

Extra verifications

While it is possible to use biometrics, such as fingerprints or facial recognition, this is more for matters of national security or business integrity at certain a level and it isn’t necessary for everyone. For most people, a simple verification code on your mobile phone sent to a pre-programmed phone number would suffice.

One precaution worth pointing out is that mobiles can be stolen and lost, so make sure messaging apps are set not to display any content until a password is put in, or this MFA process can be bypassed more easily.

Setting up MFA with Office 365

Before getting started, it’s important to understand that all user accounts for Office 365 will be either in a disabled, enabled or enforced state regarding MFA. By default, it will be disabled and will need to be changed to enabled before it can then be changed to enforced.

To do this, simply go to the Microsoft user management page, sign in, choose the accounts for which you want to enable MFA and look for the “enable” link. Once you have done that, you will see a list of the selected users and their MFA status. Choose the account(s) again from the list and click “enforce” on the right-hand side. You will then get a confirmation message saying that users will be prompted to set up extra security measures when they next log in.

For more information on Cyber Security Awareness, and what you can do to protect yourself, see https://www.gcc.co.uk/support/service-desk/cyber-security-awareness/

Asset Registration

Please register to access assets on What is Multi-Factor Authentication for Office 365?