MFA in the Company: Why and How to Implement It Without Complications

MFA in the company (multi-factor authentication) is a modern security standard that requires a user to confirm their identity with two or more different factors before gaining access to a business account or network. Most often, it is a combination of something the user knows (password) and something they have (a mobile device or security key). In a world where passwords have become the weakest link due to phishing attacks and massive breaches, MFA represents a critical layer of protection that, according to Microsoft, stops more than 99.9% of attacks on user accounts.

Key Highlights for Slovenian Companies

• MFA in the company prevents unauthorized access even in the event of an employee's password being stolen or disclosed.
• The introduction of two-factor authentication is mandatory to meet the requirements of the NIS2 directive and the General Data Protection Regulation (GDPR).
• The most popular solution for Slovenian SMEs is Microsoft Authenticator due to its integration with the Microsoft 365 environment.
• Implementation does not necessarily require expensive hardware investments, as most employees use their own or company smartphones.
• Cybersecurity is drastically improved with MFA with minimal impact on daily user productivity.

Why is MFA in the Company a Necessity Today and Not Just a Choice?

Statistics are relentless: Slovenian companies in Ljubljana, Maribor, Celje, and other regions are daily targets of automated attacks. Attackers no longer target only large corporations; small and medium-sized enterprises (SMEs) are often easier prey due to weaker protection. The core problem is that passwords are easy to guess, steal, or obtain through social engineering. Once an attacker gains an administrator's or accountant's password, they have free access to the entire business network.

With the introduction of two-factor authentication (2FA), this danger almost disappears. Even if a hacker knows your password, they do not have access to your phone or physical token, which prevents them from logging in. At VitalIT, we notice that companies without managed MFA more frequently seek help when it is already too late – when ransomware protection has failed and data is already encrypted.

Read more about protection against ransomware7 practical steps that, in addition to MFA, protect your company from the worst attacks.

Types of MFA Factors: Which One is Best for Your Company?

Not all MFA methods are equally secure. When choosing a suitable method for your IT infrastructure, we must balance security and user-friendliness. Slovenian companies most commonly use the following approaches:

For most of our clients in the Microsoft 365 environment, we recommend using the Microsoft Authenticator app. This enables 'number matching', where the user must enter a number on the phone that they see on the computer screen. This prevents 'MFA fatigue' attacks, where attackers bombard the user with notifications in the hope that someone will accidentally confirm the login.

How to Implement MFA Without Causing Resistance Among Employees?

The biggest obstacle to implementing MFA in a company is not technical but rather employee resistance to change. People do not like extra steps when logging in. Therefore, it is crucial that the introduction takes place gradually and with the right communication.

1. Education: Explain to employees why we are doing this. The goal is not monitoring, but the security of their and the company's data.
2. Pilot group: Include the IT department and management first. This will help you discover potential issues with specific applications.
3. Grace period: Set a period (e.g., 14 days) during which employees must register before MFA becomes mandatory.
4. Use of trusted locations: Configure Azure AD / Entra ID Conditional Access so that MFA is not required every time an employee is in the office on a secure network.
5. Technical support: Ensure that your IT support is available to help with settings on mobile phones.

Technical Aspects: From Microsoft 365 to VPN Connections

MFA in the company should not be limited to email. For complete security, it must be integrated everywhere where external access is possible. If your employees work from home, the VPN must necessarily be protected by an additional factor. Many companies already use advanced firewalls, such as pfSense / Netgate, which allow MFA integration for remote access.

Also, do not forget access to server infrastructure. If you still use on-premises Active Directory, consider a hybrid connection with Entra ID, which brings modern security capabilities to your local environment as well. In this process, it is important that the entire transition is documented, as organized IT environment documentation reduces maintenance costs in the future.

Advanced Concept: From MFA to Security Keys (Passkeys)

Although MFA in the company is currently the gold standard, the industry is already moving towards a 'passwordless' future. Passkeys technology eliminates the need for passwords entirely, as it uses biometrics or hardware for authentication. You can read more about this in our article on Passkeys in the company.

MFA and Legislation (GDPR and NIS2)

In Slovenia, we often encounter the question of whether MFA is legally required. Although the ZVOP-2 law or GDPR do not explicitly mention the phrase 'two-factor authentication', both require the implementation of appropriate technical and organizational measures to ensure data security. In the event of a breach and theft of personal data, the Information Commissioner will check whether the company did everything in its power to prevent it. The absence of MFA is nowadays considered negligence.

The new NIS2 directive, which affects a wider range of Slovenian companies in key sectors, is even stricter. This directive directly requires the use of multi-factor authentication as part of basic cyber hygiene. If your company operates in Ljubljana or anywhere else in Slovenia and you cooperate with larger partners in the EU, they will soon require proof of security standards from you, including MFA.

Frequently Asked Questions About MFA in Companies (FAQ)

Can employees refuse to use a private phone for MFA?

Legally speaking, a company cannot force an employee to use a private device. In such cases, the company must provide a business phone or cheaper hardware tokens (e.g., YubiKey).

What happens if an employee loses their phone with MFA set up?

The IT administrator can temporarily disable MFA for that user or create a one-time bypass code, and then set up authentication on the new device as soon as possible.

Is Microsoft Authenticator free?

Yes, the app is free, but the use of some advanced features (such as Conditional Access) requires an appropriate Microsoft 365 license (e.g., Business Premium).

Do I have to confirm MFA every time I open Outlook?

No. Typically, a trusted device is set up where the login is refreshed only every few weeks or in the case of access from an untrusted location.

Does MFA slow down work processes?

Implementing MFA extends the initial login process by approximately 5 seconds, which is negligible compared to the security it brings.

Is an SMS code secure enough for a company?

SMS is better than nothing, but it is not recommended as attackers can intercept messages or perform a SIM swap scam.

Conclusion: MFA is the Best Investment in Security

Implementing MFA in the company is probably the cheapest and most effective step you can take to improve your cyber resilience. While some security solutions are complex and expensive, two-factor authentication has become a standard supported by most modern software. Do not wait for the next phishing attempt – protect your team today.