Multi-Factor Authentication (MFA)

It does if it's deployed badly. Prompting people repeatedly through the day is the fastest way to have MFA quietly circumvented. Where licensing allows Conditional Access, prompts can be reserved for genuinely riskier sign-ins — a new device, an unusual location — so most people encounter it rarely. How you communicate the rollout matters as much as how you configure it.

Usually evidence rather than a yes: that it applies to all users including administrators, that it covers remote access and email, and that exceptions are documented and justified. "It's turned on" is rarely enough at renewal, and a coverage report is what closes the question.

A way of deciding when to challenge a sign-in based on context — who is signing in, from what device, from where, to reach what. It lets you apply strong requirements where risk is higher without applying friction everywhere. It needs the right licensing, which is one of the reasons Business Premium comes up in these conversations.

That is what break-glass accounts are for, and configuring them is part of the deployment rather than an afterthought. They are set up before enforcement is switched on, documented, and protected appropriately, so there is always a controlled route back in.

It's better than nothing and weaker than the alternatives. SMS codes can be intercepted and are vulnerable to SIM-swap attacks, which is a well-documented problem in South Africa. Authenticator apps are stronger, and hardware keys stronger still. For most businesses the sensible position is app-based by default, with hardware keys for administrators.

It should. MFA on email while remote access stays single-factor is a common and dangerous gap. We look at remote access, line-of-business applications and administrative interfaces as part of the rollout, not just the Microsoft 365 sign-in.