Posted on January 22, 2019 by Louise Howland
Multi-Factor Authentication (MFA), is something everyone will have experienced, it’s the additional levels of security used when you sign into a banking app, or when you try to change a password and a verification code is sent to your mobile phone, or when you are asked to answer additional security questions after already providing your password. All of these examples are extra security measures that allow you to prove you are who you say you are and provide peace of mind that hackers can’t impersonate you. Up until now, most organisations have not considered implementing this additional layer of protection into their corporate data, but with Office 365 it’s now a realistic, cost effective option to improve the protection of your business data.
Obviously, the main reason for using MFA is security, if it is set-up correctly it eliminates the risk of an account being compromised because of a weak, shared or known password. Increasing numbers of accounts (including Office 365) are being compromised, because users have used the same password across different systems, such as LinkedIn and Adobe, (which have had their account databases stolen) giving hackers the ability to hack users work accounts. With MFA even if someone knows your username and password, they are not able to log-in without access to your mobile phone or land-line (if that’s set-up as another authentication mechanism).
It is possible to set-up MFA to not to be required when logging in from a trusted network, so users won’t become frustrated by having to provide additional authentication when in the office.
Choosing the security verification method in Office 365
When out of the office a user can log in as normal using their username and password, if they are using an authenticator app on a mobile device (which is certainly the easiest option) they get prompted to approve the login.
Using an authenticator app
If they click ‘approve’ they are logged straight in. Other options are using a code from the authenticator app, being sent a code by text, or a phone call with a recorded message giving a code.
So, the user experience should be quick and fairly seamless.
Introducing MFA must be planned as a project as it’s potentially disruptive to end-users and could leave them unable to work. The risks organisations need to consider prior to implementing MFA, to ensure a smooth implementation experience are
When implementing MFA for organisations we follow several golden rules.