Multi-factor authentication is the single most effective control an Australian business can deploy against account compromise. Microsoft's own telemetry has consistently shown that MFA blocks the overwhelming majority of automated identity attacks, and the Australian Signals Directorate lists it as one of the eight essential mitigation strategies. Despite that, we still assess Microsoft 365 tenants every month where MFA is enforced for a handful of administrators and nobody else.
This guide covers what MFA is, which methods are available in Microsoft 365, how to roll it out across an entire tenant without generating a week of support tickets, how MFA maps to Essential Eight Maturity Levels 2 and 3, and how to fix the problems that come up in practice.
What is multi-factor authentication and why does it matter?
Multi-factor authentication requires a user to present two or more independent proofs of identity before access is granted. The classic categories are something you know (a password), something you have (a phone, a hardware key), and something you are (a fingerprint or face).
Passwords alone fail for predictable reasons. They are reused across services, harvested in bulk from unrelated breaches, guessed through password spray attacks against common patterns, and phished through convincing fake sign-in pages. An attacker with a valid Australian business email address and password can read mail, redirect invoices, impersonate a director and pivot into SharePoint — all without triggering a single antivirus alert, because nothing malicious has been installed.
Business email compromise remains the highest-cost cybercrime category reported to the Australian Cyber Security Centre for small and medium business, and the entry point is almost always a credential rather than malware. MFA breaks that chain: the harvested password on its own is no longer sufficient.
Two things are worth being clear about. First, MFA is not unbreakable — adversary-in-the-middle phishing kits can relay a session token in real time, which is exactly why phishing-resistant methods exist. Second, MFA on its own is not a security programme. It works alongside Conditional Access, device compliance and monitoring, which is how we deploy it as part of managed security services and managed Entra ID.
MFA options for Microsoft 365 in Australia
Microsoft 365 supports several authentication methods. They are not equivalent, and the choice materially affects both security and user experience.
Microsoft Authenticator app (push notification with number matching). The default recommendation for most Australian businesses. The user receives a push notification and must type a two-digit number displayed on the sign-in screen into the app. Number matching defeats MFA fatigue attacks, where an attacker repeatedly triggers prompts hoping the user taps Approve. Free, works on iOS and Android, and supports additional context such as the sign-in application and location.
Authenticator app (TOTP code). A six-digit rotating code, useful where push notifications are unreliable or the device has no data connection. Slightly more friction, no number matching protection, but still strong.
FIDO2 security keys (YubiKey and equivalents). Phishing-resistant. The key cryptographically verifies the domain it is authenticating to, so a fake sign-in page cannot relay the credential. Recommended for Global Administrators, finance staff who authorise payments, executives, and anyone required to meet Essential Eight Maturity Level 3. Budget roughly $70–$120 AUD per key and buy two per user so there is a backup.
Windows Hello for Business. Biometric or PIN sign-in bound to the TPM in a specific device. Phishing-resistant, effectively frictionless, and the best experience available on managed Windows endpoints. Requires devices enrolled in Intune or hybrid-joined to Entra ID.
Passkeys. Device-bound or synced FIDO2 credentials, now supported in the Authenticator app. Phishing-resistant with a phone-based experience, and increasingly the practical path to Maturity Level 3 without buying hardware for every user.
SMS and voice call. Deprecated in practice. Vulnerable to SIM swap and interception, and explicitly not phishing-resistant. Acceptable only as a temporary fallback during rollout for users without smartphones, and it should be removed from the authentication methods policy once migration is complete.
Certificate-based authentication. Used in regulated and government-adjacent environments where a PKI already exists. Powerful, but the administrative overhead is only justified where the certificate infrastructure is already managed.
How to enable MFA for all Microsoft 365 users
The mechanism you use matters as much as the decision to enforce MFA. There are three options in Microsoft 365, and only one of them is appropriate for a business in 2026.
Security defaults — a free, all-or-nothing toggle that enforces Authenticator registration for every user and blocks legacy authentication. Acceptable for very small businesses with no Entra ID P1 licensing, but it offers no exclusions, no trusted-location logic, and no per-application control.
Per-user MFA (legacy) — the original toggle in the Microsoft 365 admin centre. Microsoft has been retiring this path. Do not build on it.
Conditional Access — the correct approach for any business with Microsoft 365 Business Premium, E3 or E5. Conditional Access evaluates signals (user, group, application, device compliance, location, sign-in risk) and applies grant controls such as "require multi-factor authentication" or "require a compliant device". It supports report-only mode, emergency access accounts, and staged rollout by group.
Step 1 — Audit current authentication methods
Before changing anything, run the Authentication Methods Activity report and the MFA registration report in the Entra admin centre. You need to know how many users have no method registered, how many are on SMS only, and which accounts are service accounts or shared mailboxes that will break under enforcement.
Step 2 — Create emergency access accounts
Create two cloud-only Global Administrator break-glass accounts with long random passwords stored offline, excluded from Conditional Access policies, and monitored with a sign-in alert. Without these, a misconfigured policy can lock every administrator out of the tenant.
Step 3 — Configure the authentication methods policy
In Entra ID, enable Microsoft Authenticator with number matching and additional context, enable FIDO2 security keys and passkeys, and disable SMS and voice for all users except a temporary migration group. Set the Authenticator to show application name and geographic location.
Step 4 — Block legacy authentication
Legacy protocols such as IMAP, POP and SMTP AUTH cannot present a second factor, so an attacker who finds them open bypasses MFA entirely. Create a Conditional Access policy blocking legacy authentication clients for all users, run it in report-only mode first, and remediate any device or application still using those protocols.
Step 5 — Deploy the MFA policy in report-only mode
Create a Conditional Access policy targeting all users, all cloud applications, excluding break-glass accounts, with the grant control "require multi-factor authentication". Run it in report-only mode for one to two weeks and review the What If and sign-in logs for accounts that would fail.
Step 6 — Register users in waves
Communicate to staff first — what is changing, why, and what they need to do. Enable the registration campaign so users are nudged to set up the Authenticator app at sign-in. Roll out by department in waves of 20 to 50 users so the helpdesk can absorb the questions.
Step 7 — Enforce and harden
Switch the policy from report-only to on. Then add the second layer: require compliant or hybrid-joined devices for access to Exchange Online and SharePoint, require phishing-resistant MFA for administrator roles, restrict sign-ins from unexpected countries, and set sign-in frequency for high-privilege sessions.
Step 8 — Monitor and review
Review sign-in logs weekly for MFA failures and blocked legacy authentication attempts, monitor the break-glass accounts, and re-run the registration report monthly to catch new starters who slipped past the process.
MFA and Essential Eight compliance — Maturity Level 2 and 3
Multi-factor authentication is one of the eight mitigation strategies in the ACSC Essential Eight, and the requirements tighten sharply as maturity increases.
At Maturity Level 1, MFA is required for users accessing internet-facing services that process sensitive data, and for privileged users. Microsoft Authenticator with number matching satisfies this.
At Maturity Level 2, MFA is required for all users of internet-facing services, all privileged access, and access to important data repositories. Authentication events must be centrally logged and monitored, and logs must be protected from modification. In practice this means Conditional Access covering every user and every cloud application, with sign-in logs exported to a retained workspace.
At Maturity Level 3, MFA must be phishing-resistant — FIDO2 security keys, passkeys, Windows Hello for Business, or certificate-based authentication. Push notifications and TOTP codes are no longer sufficient because they can be relayed by adversary-in-the-middle tooling. This is the change most Australian businesses have not yet made, and it is the reason we recommend budgeting for hardware keys or passkeys for privileged users now rather than at audit time.
Microsoft 365 Business Premium provides everything needed for Maturity Level 2 MFA through Entra ID P1 Conditional Access. Maturity Level 3 adds hardware or platform authenticators, and generally benefits from Entra ID P2 for risk-based policies and access reviews. We cover the full mapping in our governance and compliance readiness assessments, and deploy the underlying controls as part of Secure Essentials.
Common MFA problems and how to fix them
"A user has lost their phone." Have a documented reset process: verify identity out of band (a video call or a manager confirmation, never an email request), remove the registered method in Entra ID, issue a Temporary Access Pass, and require re-registration. Temporary Access Passes are the correct tool here — sharing a bypass code by SMS is not.
"Shared mailboxes and service accounts are breaking." Shared mailboxes should have sign-in blocked and be accessed through delegation, not credentials. Application and service accounts should use managed identities, certificate credentials or workload identities, and be excluded from user MFA policies with compensating controls such as IP restrictions.
"Staff are approving prompts they did not trigger." Enable number matching and additional context, and educate staff to report unexpected prompts. Repeated unexpected prompts mean the password is already compromised — reset it and review the sign-in logs.
"Multi-function devices and scan-to-email stopped working." These usually rely on SMTP AUTH. Move them to a dedicated authenticated relay or Direct Send with a restricted connector, rather than reopening legacy authentication tenant-wide.
"Users complain about being prompted constantly." Excessive prompting is usually a policy design problem. Configure sign-in frequency sensibly, allow token persistence on compliant managed devices, and use device compliance rather than repeated interactive prompts as the trust signal.
"Travelling staff are blocked." Location-based policies need an exception process. Prefer risk-based and compliance-based controls over rigid country blocks, and maintain a documented travel exemption workflow with an expiry date.
"Administrators are exempt for convenience." This is the most dangerous exception of all. Privileged accounts warrant the strongest method available, not the weakest — use phishing-resistant MFA and Privileged Identity Management for just-in-time role activation.
Getting MFA right the first time
MFA rollouts fail on communication and edge cases, not on technology. The technical configuration takes an afternoon; the registration campaign, service account remediation, legacy protocol cleanup and helpdesk preparation take a fortnight. Businesses that plan for that sequence complete the project without disruption. Businesses that flip the switch on a Monday morning spend the week resetting accounts.
Mycelium 365 deploys MFA and Conditional Access for Australian businesses as part of our managed Entra ID service, including phishing-resistant authentication for privileged roles, break-glass account governance, legacy authentication remediation and Essential Eight maturity reporting.
Mycelium 365 manages MFA deployment for Australian businesses
The MFA guide above explains how multi-factor authentication works and how to configure it in Microsoft 365. If you want MFA deployed, managed, and enforced across your entire organisation — without relying on each user to set it up themselves — Mycelium 365 handles the full deployment.
What Mycelium 365 manages as part of MFA deployment: Entra ID Conditional Access policy configuration (enforcing MFA for all users, all apps, all devices), Microsoft Authenticator rollout and user enrolment (including staff who resist or struggle with self-service setup), named location exclusions (trusted office IP ranges where MFA can be relaxed for low-risk sign-ins), break-glass account configuration (emergency admin access if MFA is unavailable), Authenticator app troubleshooting and helpdesk support, and monthly MFA adoption reporting (showing which users are enrolled, which authentication methods are in use, and which sign-ins MFA blocked).
MFA management is included in all Mycelium 365 managed packages from Secure Essentials ($95/user/month) — no additional charge for MFA configuration or ongoing management. For businesses not yet on a managed package, Mycelium 365 offers MFA deployment as a fixed-price project engagement. Contact Mycelium 365 to discuss MFA deployment for your business, or book a discovery call to get started.
MFA deployment is the single highest-impact security control available to Australian businesses — Essential Eight Maturity Level 2 requires MFA on all internet-facing services. If your business is not yet enforcing MFA, this is the place to start.