Does MFA significantly slow down employees' work?

Not in a well-configured environment. With appropriate rules (Conditional Access), MFA is only triggered in higher-risk situations: when logging in from an unknown device or from a foreign country. Daily login in the office remains simple.

For a regular user, SMS is significantly better than nothing. For administrator and business-critical accounts, we do not recommend SMS: attackers bypass this method via SIM swapping. It is better to use an app or a physical security key.

What happens if a coworker loses their phone?

With an organized process (backup codes, second device, or administrator), an admin can reset the MFA on the account and the user can set it up on a new device. Without a process, losing a phone can mean several days without access to work services.

Is MFA mandatory for all services?

For Microsoft 365, VPN, server access, and all administrator accounts, yes. For internal services that are not accessible from the internet, it makes sense to assess the risk: MFA is often useful there too, even if not strictly mandatory.

Cybersecurity

MFA(MFA)

Angleški izraz: Multi-Factor Authentication

Kratka definicija

A login method that requires a second proof of identity in addition to a password, most commonly a confirmation in an app on a phone.

Kaj pomeni MFA?

MFA (Multi-Factor Authentication) is an authentication process in which a user proves their identity using two or more independent pieces of evidence. Traditionally, these are: something you know (password), something you have (phone, security key), and something you are (fingerprint, face).

In business use, a combination of a password and confirmation in an authentication app (such as Microsoft Authenticator, Google Authenticator) prevails. SMS messages are a less secure choice due to the risk of SIM swapping, but they are still better than a password alone.

MFA and 2FA are often used as synonyms. Strictly speaking, 2FA is a subset of MFA where exactly two factors are used.

Zakaj je to pomembno za podjetja?

The vast majority of successful breaches into business systems occur via stolen or guessed passwords. MFA effectively breaks this attack path: even if an attacker knows the password, they cannot complete the login without the second factor.

Microsoft and other providers report that MFA prevents over 99% of such attacks. This is a ratio between effort invested and security gained that is rarely found in the IT environment.

Kje se to pojavi v praksi?

Typical usage: logging into Microsoft 365 (Outlook, Teams, SharePoint) requires a confirmation in the Microsoft Authenticator app in addition to a password. When logging in from a known device in the office, MFA is not triggered, but it is triggered when logging in from abroad or from a new device. This is determined by Conditional Access rules.

Another common example: a VPN connection to the company requires a password and a TOTP code from the app. Even if someone steals a laptop and the password, they cannot enter the internal network without the coworker's phone.

Najpogostejše težave ali napake

The most common mistake is partial implementation: we have MFA, but not for all users, not for all services, and not for administrator accounts. Admin accounts without MFA are the primary targets of attacks.

Another common issue: MFA via SMS for administrator accounts. Attackers bypass this type of MFA via SIM swapping. Apps or hardware security keys (FIDO2) are more suitable for important accounts.

A third mistake: lack of a plan for phone loss. Without an established backup method (such as backup codes), a single lost phone can cause a user to be locked out of the system for days.

Kako pri tem pomaga VitalIT

At VitalIT, we help companies set up MFA so that it is secure while not interfering with daily work. For existing environments, we first check where MFA is already running and which accounts are still exposed.

In practice, we enable MFA in Microsoft 365, set up logical Conditional Access rules (for example, 'no MFA only in the office'), prepare instructions for users, and take care of the procedure for phone loss. We adapt the solutions to the actual environment and the agreement with the client.

Kibernetska varnost Cloud in Microsoft 365

Povezane storitve

Kibernetska varnost Cloud in Microsoft 365

Pogosta vprašanja

Does MFA significantly slow down employees' work?: Not in a well-configured environment. With appropriate rules (Conditional Access), MFA is only triggered in higher-risk situations: when logging in from an unknown device or from a foreign country. Daily login in the office remains simple.
Is SMS MFA enough?: For a regular user, SMS is significantly better than nothing. For administrator and business-critical accounts, we do not recommend SMS: attackers bypass this method via SIM swapping. It is better to use an app or a physical security key.
What happens if a coworker loses their phone?: With an organized process (backup codes, second device, or administrator), an admin can reset the MFA on the account and the user can set it up on a new device. Without a process, losing a phone can mean several days without access to work services.
Is MFA mandatory for all services?: For Microsoft 365, VPN, server access, and all administrator accounts, yes. For internal services that are not accessible from the internet, it makes sense to assess the risk: MFA is often useful there too, even if not strictly mandatory.