Multi-factor authentication is the single most impactful security control a small business can implement — and one of the cheapest. It’s included at no additional cost with Microsoft 365, Google Workspace, and most modern business platforms. It takes less than a day to deploy across an entire organization. And according to Microsoft’s own research, it blocks 99.9% of automated account compromise attacks. If there’s one change we could make to every business in Western New York today, this would be it.
What Multi-Factor Authentication Actually Is
Authentication is how a system confirms you are who you say you are. Single-factor authentication is a password — one thing you know. Multi-factor authentication requires a second piece of evidence from a different category: something you have (a phone, a hardware key) or something you are (a fingerprint, a face scan).
The practical effect is significant: even if an attacker steals your password — through a phishing page, a data breach, or credential stuffing from a previous breach — they cannot access your account without the second factor. Your password is compromised. Your account is not. That separation is the entire value of MFA, and it’s why the statistics on its effectiveness are so dramatic.
Why the 99.9% Statistic Is Real
Microsoft’s 99.9% figure reflects a straightforward reality: the overwhelming majority of automated account attacks rely on stolen, guessed, or purchased credentials. . Feed the credential into the target platform — done. MFA renders this attack class ineffective because the attacker has the password and cannot complete authentication without the second factor.
You can check if your credentials have leaked here: Have I Been Pwned: Check if your email address has been exposed in a data breach
The fraction of attacks that bypass MFA require significantly more sophisticated and targeted techniques — SIM swapping, advanced social engineering, or physical device compromise. These attacks do happen, but they require substantially more effort and are far less common at the small business scale. For the threat profile that most WNY businesses actually face, MFA is not a marginal improvement. It’s a near-complete defense against credential-based account compromise.
Types of MFA: Which Is Best for Your Business?
- Authenticator app (Microsoft Authenticator, Google Authenticator): Our standard recommendation for most users. Time-based one-time codes generated on your phone. Resistant to most phishing and stuffing attacks. Included at no cost.
- Push notification approval: Convenient — the app asks you to approve a login on your phone. Effective, but vulnerable to ‘MFA fatigue’ attacks where attackers send repeated approval requests hoping the user approves one accidentally. Mitigated by enabling number-matching in the Microsoft Authenticator settings.
- SMS text message codes: Better than no MFA. However, the weakest option — vulnerable to SIM swapping, where an attacker convinces your carrier to redirect your number to their device. Avoid where stronger options are available.
- Hardware security keys (YubiKey): The strongest MFA option, virtually immune to phishing. Best reserved for high-privilege accounts — administrators, financial personnel, executives — where the cost per key is justified by the access being protected.
- Number matching (Microsoft Authenticator): Requires the user to match a number displayed during login to one shown in the app, preventing accidental approval of attacker-generated push requests. Enable this for all push notification MFA deployments.
How We Deploy MFA Across Microsoft 365 and VPN
For managed clients, our MFA deployment follows a standard sequence: we enable Microsoft Entra ID Conditional Access policies requiring MFA for all users, enforce MFA on VPN connections and any other internet-accessible systems, and deploy Microsoft Authenticator across the organization through a guided enrollment process that walks each user through setup in about two minutes.
For a 20-person organization, full MFA enrollment typically takes an afternoon, including light user training. We cover what MFA is, what to expect, and — critically — what to do when an MFA approval request arrives unexpectedly: deny it immediately and call us. An unexpected approval request is almost always an active attack attempt.
Answering the Common Objections
“It’s too inconvenient.” MFA adds roughly three seconds to a login. That is a negligible friction cost against the catastrophic potential of a compromised account — a cost measured not in seconds but in days of recovery, legal exposure, and reputation damage.
“Our passwords are strong enough.” Password strength is irrelevant if the password is stolen through phishing or appears in a breach database. MFA is the safeguard that makes stolen credentials useless regardless of how the theft occurred.
“My team doesn’t all have smartphones.” Hardware keys work for anyone without a smartphone. The security gain is worth the equipment cost. If your Microsoft 365 environment doesn’t have MFA enforced on every account, that’s a gap we can close in one afternoon. Reach out at Contact Us.
