Enable Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) is one of the most effective security controls available. Even if a password is stolen, attackers cannot easily access an account without the additional verification factor.

Enable MFA for all users, with priority given to privileged and administrative accounts. Whenever possible, use phishing-resistant authentication methods such as passkeys, FIDO2 security keys, or certificate-based authentication.

Implementation Steps

• Enable MFA for all user accounts.
• Require MFA for all administrator and privileged accounts.
• Prefer phishing-resistant authentication methods (FIDO2, passkeys, Windows Hello for Business, or certificate-based authentication).
• Disable legacy authentication protocols that bypass MFA.
• Apply Conditional Access policies to enforce MFA based on risk, device, or location.
• Register multiple authentication methods for account recovery.
• Regularly review MFA registration and enforcement reports.
• Educate users about MFA fatigue and push notification attacks.