Multi-factor authentication (MFA) is the single most effective control an Australian business can switch on to stop account compromise. It is also one of the most misunderstood — business owners know they "should have MFA" but are often unclear on what it actually is, which type to use, or why insurers and regulators now demand it. This guide explains MFA in plain English: what it is, how it works, the different types, what Australian compliance frameworks require, and how to set it up properly in Microsoft 365.
What is MFA?
Multi-factor authentication is a login security control that requires two or more independent proofs of identity before granting access to an account. The proofs come from different categories: something you know (a password or PIN), something you have (a phone, an authenticator app, or a hardware security key), and something you are (a fingerprint or face scan). A password alone is single-factor authentication — one proof, from one category. MFA adds at least one more factor from a different category, so a stolen password by itself is no longer enough to get in.
This matters because passwords fail constantly. Credential stuffing attacks take the billions of username-and-password combinations leaked in data breaches and replay them against Microsoft 365, banking portals, and business applications — and they work because people reuse passwords. Phishing emails trick staff into typing credentials into fake login pages that capture them in real time. Brute force attacks simply guess weak passwords at machine speed. In every one of these scenarios, the attacker ends up with a working password. MFA is what stops that password from being useful: without the second factor — the phone, the app approval, the security key — the login fails.
The impact is not theoretical. Microsoft's own telemetry shows that MFA stops 99.9% of automated account attacks. Among the Australian businesses we onboard, the tenants that have already experienced an account compromise are almost always the ones where MFA was "planned" but never enforced. For a plain-language definition you can share with staff, see our multi-factor authentication glossary entry.
How does MFA work?
The day-to-day experience of MFA is simpler than most people expect. A typical Microsoft 365 login with MFA looks like this: you enter your email address and password as usual; Microsoft 365 then sends a prompt to your phone; you approve the prompt in the authenticator app (or enter a six-digit code); access is granted. The whole second step takes about three seconds, and on trusted devices it typically only happens periodically rather than at every sign-in.
There are three common ways the second factor is delivered. A push notification sends an approval request to the authenticator app on your phone — you tap "Approve" and you are in. This is the most convenient option and the one Mycelium 365 deploys by default. A TOTP code (time-based one-time password) is the six-digit code that regenerates every 30 seconds in apps like Microsoft Authenticator or Google Authenticator — you type it in during login. Passwordless sign-in removes the password entirely: the authenticator app, Windows Hello biometric, or a FIDO2 security key becomes the only factor, backed by cryptographic proof rather than a shared secret.
One detail matters more than any other here: number matching. Early push-based MFA simply asked "Are you trying to sign in? Yes/No." Attackers exploited this with MFA fatigue attacks — triggering dozens of push prompts until a distracted employee tapped Approve just to make them stop. Number matching defeats this: the login screen displays a two-digit number, and you must type that number into the authenticator app. An attacker spamming prompts cannot know the number shown on your screen, so blind approval no longer works. Microsoft now enforces number matching on all Microsoft Entra tenants — if your MFA was configured years ago, it is worth confirming number matching is active.
Types of MFA — which should your business use?
Not all second factors are equal. The four main types, from least to most secure:
SMS codes are the weakest option. A text message with a six-digit code is better than no MFA at all, but SMS is vulnerable to SIM swapping — an attacker convinces your mobile carrier to port your number to their SIM, and your codes arrive on their phone. The Australian Signals Directorate explicitly recommends against SMS-based MFA where stronger options exist. If your business is using SMS codes today, upgrading is a priority.
Authenticator apps (Microsoft Authenticator, Google Authenticator) generate codes on the device itself or deliver push approvals with number matching. Nothing travels over the phone network, so SIM swapping is irrelevant. This is the right default for almost every Australian business — free, fast, and secure. For staff setup, see our guide to setting up Microsoft Authenticator for business.
Hardware security keys (FIDO2) are physical USB or NFC keys that provide the strongest available authentication. The key cryptographically proves its presence — there is no code to phish and no prompt to fatigue. Keys are the right choice for privileged accounts: IT administrators, finance staff with payment authority, and executives. The trade-off is cost ($50–$100 per key, plus spares) and the management overhead of physical devices.
Biometrics — Windows Hello for Business fingerprint and face recognition — combine something you are with something you have (the device itself stores the biometric; it never leaves the laptop). Biometric sign-in is both the most convenient option and highly secure, and it is built into every modern Windows 11 device at no extra cost.
Mycelium 365's standard recommendation for Australian businesses: Microsoft Authenticator with push and number matching for all staff, FIDO2 keys for admin and finance roles, and Windows Hello enabled on all company devices. SMS only as a last-resort recovery method, never as the primary factor.
Is MFA required in Australia?
Increasingly, yes — from three directions.
Essential Eight. The ACSC's Essential Eight framework — the baseline cyber security standard for Australian business — requires MFA at Maturity Level 1 for all internet-facing services, which explicitly includes Microsoft 365. At Maturity Level 2, the requirement tightens: MFA must be phishing-resistant for privileged users, which in practice means authenticator apps or FIDO2 keys rather than SMS. Any business tendering for government work, holding cyber insurance, or following its industry body's security guidance is working to Essential Eight, and MFA is non-negotiable within it. Our Essential Eight compliance service includes MFA enforcement as a foundational step.
Cyber insurance. Australian cyber insurers now routinely require MFA as a minimum control before issuing or renewing a policy — and increasingly specify MFA for remote access, email, and administrative accounts by name. A claim can be denied if an attacker entered through an account that should have had MFA enabled and did not.
Regulatory obligations. APRA CPS 234 requires regulated financial services entities to implement controls commensurate with threats — and MFA on remote access and privileged accounts is the expected baseline in APRA supervision. The ASD's guidance for all Australian organisations names MFA as one of the highest-priority mitigations. If your business handles personal information under the Privacy Act, MFA is part of the "reasonable steps" you are obliged to take to protect it.
The short version: whether or not a law names MFA for your specific business today, your insurer, your clients' security questionnaires, and the Essential Eight all effectively require it. The question is no longer whether to deploy MFA — it is whether it is deployed correctly.
How to set up MFA in Microsoft 365
Microsoft 365 includes MFA capability in every licence tier, but it is not switched on by default. A proper deployment has four steps:
1. Choose your enforcement mechanism. Microsoft offers Security Defaults — a one-switch option that enforces MFA for all users with sensible baseline settings — or Conditional Access policies in Entra ID, which give granular control (require MFA always, only from untrusted networks, only for admins, and so on). Security Defaults suits small businesses under about 20 users with Microsoft 365 Business Basic or Standard. Businesses on Business Premium or E3 should use Conditional Access, which is more flexible and more precise.
2. Deploy Microsoft Authenticator to staff. Each user registers their phone as their second factor — scanning a QR code links the app to their account. For anything beyond a handful of staff, devices should be enrolled in Intune and the app pushed automatically, with registration enforced at next sign-in. Doing this in a single scheduled change window — with communication to staff beforehand — avoids the classic failure mode of MFA "deployments" that linger at 60% coverage for years.
3. Enforce the policy. Set the Conditional Access policy to report-only first, review what would have been blocked, then switch to enforcing. Block legacy authentication protocols (IMAP, POP, basic SMTP auth) at the same time — these bypass MFA entirely and are the standard attacker workaround.
4. Monitor sign-in logs. Entra ID sign-in logs show every authentication event, including failed MFA attempts and impossible-travel detections. Reviewing these weekly for the first month surfaces both misconfigurations and active attack attempts — and it is common to see credential stuffing attacks against your tenant within days of looking.
Mycelium 365 includes MFA deployment and Conditional Access configuration in every onboarding, delivered through our managed Entra ID service — typically completed in the first two weeks of an engagement.
MFA vs passwordless — what's the difference?
MFA adds a second factor on top of a password; passwordless removes the password entirely. With passwordless sign-in, you prove your identity with a biometric (Windows Hello face or fingerprint) or a FIDO2 security key — there is no password to phish, guess, reuse, or leak. The credential is a cryptographic key pair stored on your device or security key, which never travels and cannot be replayed.
Passwordless is clearly the long-term direction — Microsoft has committed to it, and every current Windows 11 device ships with the hardware to support it. But for most Australian businesses today, well-configured MFA is the right immediate step: it works with every application including legacy ones, requires no new hardware, and staff already understand it. The practical roadmap Mycelium 365 recommends is sequential — enforce MFA with Microsoft Authenticator across all accounts now, enable Windows Hello on company devices, deploy FIDO2 keys to privileged users, and then move the organisation to passwordless sign-in as application support matures.
Both capabilities live in Microsoft Entra ID, and both are included in licences most businesses already pay for.
MFA for Australian financial services and fintech — APRA requirements
For Australian financial services organisations and fintechs, MFA is not optional — it is explicitly required by APRA's CPS 234 Information Security standard, which mandates robust access controls for all systems handling financial data. APRA-regulated entities (banks, insurers, superannuation funds, and their service providers) must implement MFA for all remote access and all privileged access to systems holding sensitive customer data. For fintech companies not yet under APRA supervision, the Australian Prudential Regulation Authority's requirements still apply if you process payments or hold financial data on behalf of regulated institutions.
On the specific question of SMS versus authenticator apps: APRA and ASD both recommend against SMS as a primary MFA factor for financial services use cases. SMS is vulnerable to SIM-swapping attacks, where a threat actor convinces a carrier to transfer a phone number to a new SIM, intercepting the MFA code. For financial services, Microsoft Authenticator with number matching, or FIDO2 hardware keys for privileged accounts, is the recommended implementation.
Mycelium 365 configures Microsoft Entra Conditional Access and MFA policy for Australian financial services businesses — contact us to discuss your APRA compliance posture.
If you want help getting MFA enforced across your Microsoft 365 tenant — or planning the move to passwordless — book a discovery call and we will scope it for your environment.