Almost every small business turns on multi-factor authentication for Microsoft 365, ticks the box, and moves on. The trouble, as a recent campaign that threw tens of millions of login attempts at M365 accounts made clear, is that MFA only protects the doors it is actually applied to. Attackers do not pick the locked door. They walk the building looking for the one that was left off the policy. This guide is the practical walk-through of closing those doors, in plain language, without needing to be a Microsoft administrator to follow along.
Why MFA on its own is not enough
Turning on MFA is the single best thing you can do for your accounts, and you should absolutely do it. But "MFA is on" usually means it is on for most people, on most apps, most of the time. Attackers make their living in the gaps: the one service account it was never applied to, the older sign-in method that skips the prompt, the setting that was switched to "watch but don't block." The goal of this guide is to turn "mostly" into "everywhere," because a control with a gap is a control an attacker will find.
Close the gaps in your MFA policy
If you use Microsoft 365 Business Premium or any plan with Conditional Access, four settings decide whether your MFA actually holds:
- Every user, not just admins. It is common to protect administrator accounts and leave regular staff on password-only. But a normal user's mailbox is exactly what an attacker wants for invoice fraud and internal phishing. Apply MFA to everyone.
- Every app, not just some. Scope MFA to "all cloud apps," not a hand-picked list. A policy that covers Outlook but misses another connected app leaves a way in.
- Every location. Requiring MFA only from "unfamiliar" locations sounds clever but is easily sidestepped. Require it everywhere, including your office.
- Enforce, not report-only. Conditional Access policies can run in "report-only" mode, where they log what they would have done but never actually block anyone. It is meant for testing. A policy left in report-only is a policy that is switched off. Confirm yours are enforcing.
Shut the legacy side doors
The reason a password alone can still work, even with MFA on, is old sign-in methods that predate modern security and never present an MFA prompt. The main culprits:
- Legacy (basic) authentication. Older protocols used by dated mail apps send a username and password straight through, with no second factor possible. Microsoft has been retiring these, but they can linger. Block legacy authentication tenant-wide.
- ROPC and command-line sign-in. There are programmatic sign-in paths, including one called ROPC (Resource Owner Password Credentials), that hand a password directly to Microsoft's token service without an interactive prompt. This is precisely the door the recent password-spraying campaign used. Unless you have a specific, understood need for it, it should be blocked.
For very small tenants that do not use Conditional Access, Microsoft's Security Defaults is a free, one-switch option that enforces MFA for everyone and blocks legacy authentication automatically. It is less flexible than Conditional Access, but for a small business with no dedicated IT, it is far better than a half-configured setup. Use one or the other, deliberately, not a confused mix.
Protect the admin accounts first
Your global administrator accounts are the keys to the entire tenant, so they deserve extra care: give them phishing-resistant MFA such as a passkey or hardware key (see our guide on passwords and passkeys), do not use them for day-to-day email and browsing, and keep the number of admins small. One compromised admin is a far worse day than one compromised mailbox.
Watch the sign-ins
Locking the doors is most of the job; noticing when someone is rattling the handles is the rest. Microsoft 365 logs every sign-in, and even without add-ons you can review failed sign-ins and, on the right plans, turn on risk-based policies that automatically challenge or block logins that look suspicious (impossible travel, a known-leaked password, an anonymous network). At minimum, someone should be alerted to unusual sign-in activity rather than finding out weeks later. This is a core part of what a managed security service watches for you.
A short checklist
If you do nothing else, confirm these:
- MFA applied to every user, every cloud app, every location.
- Conditional Access policies set to enforce, not report-only (or Security Defaults on for smaller tenants).
- Legacy authentication blocked; ROPC and command-line password sign-in blocked unless you truly need them.
- Admin accounts on phishing-resistant MFA, kept few and separate.
- Someone reviewing or alerted to unusual sign-ins.