Coming Soon to Office 365: Multi-Factor Authentication

Hello everyone,

Over the next few weeks, we will be rolling out Multi-Factor Authentication (MFA) in Office 365. This will add a much needed layer of security and protection against compromised accounts, primarily to phishing.

Most of you should already be familiar with MFA, sometimes called 2-Factor Authentication. We already use MFA in some of our hosted services such as Paycom and Intacct.

For a quick overview of what MFA is and how important it is, watch this 4-minute Youtube video.

As of last year, all new companies that purchase Office 365 have MFA enabled by default. Microsoft did not enable it on existing customers because it would create a tech-support nightmare by enabling an entire orginazation all at once. For that reason, we'll be following Microsoft's recommended deployment plan by rolling it out in stages. We started by enabling it on all IT Staff a couple of weeks ago. We've had very few issues and will be rolling it out to the staff soon. Once MFA is enabled on your account, it will be mandatory and cannot be disabled.

Preregistration

I strongly encourage you all to to preregister for MFA before we roll it out. There are a some benefits to registering early. The first benefit is you are not being prompted to set up MFA at a bad time. Once we enable MFA for your account, you will not be able to bypass the registration process and will be required to register before you can access your email account through the web. If you are in the middle of an important meeting or needing to quickly look up something from an email and are prompted to spend the time to set up MFA, it could be really frustrating for you and anyone else waiting for you. Another benefit is there is a reduced chance of an already-compromised account to have the hacker set up the MFA settings using their own phone number or authenticator app, locking you out of your account completely. Since the first time you login to your account after MFA is enabled will prompt you to set up MFA, if the hacker happens to be the first person to login with your account via the web, they'll be the one presented with the MFA registration process.

I have created some instructions for preregistration on our IT Sharepoint page here.