Office 365 - Security Options For Authentication

For those of you who have selected Office 365 as your go-to cloud subscription service for top of the line Microsoft services and tools, security was probably a top concern. If you opened this article because you are curious to learn more about the security aspects of Office 365, specifically Multi-factor authentication, then you have come to the right place. Multi-factor authentication is a popular term that is thrown around in security conversations, but do you know what it is or what it does? We want to make sure you do!

---

What is Multi-Factor Authentication (MFA)?

You might have heard MFA referred to as two-step verification, two-factor authentication, multi-step or multi-factor verification. It all refers to the same idea which is an authentication method that provides access after successfully presenting two or more pieces of evidence as verification mechanisms. Here are some common authentication methods you might have heard of before:

• Password
• Security question
• Secondary email address
• Authenticator applications
• Hardware tokens
• SMS, voice call or app passwords

Most systems by default use only a single authentication option and that’s really all you need. However, passwords, security questions or even email accounts can be hacked, stolen or misused. You can greatly reduce the opportunity for someone breaking into your content by memorizing an incredibly obscure password and never recording it on any physical device… but who has the time to do that? It’s much easier to increase the security by requiring an additional method of authentication. Keep in mind, additional layers of security make your content harder to hack but it also presents a degree of effort for the user as well.

Security is a funny thing. Too much security and you begin to lose your target audience. Users are required to pause and hop over obstacles to access their accounts. It’s very difficult to implement a high level of security unless every member of the team is equally dedicated to protecting your data. If your security is too low, people may become careless in managing the content and thus creating more opportunity for security failure. Rest assured, multi factor authentication is a simple enough measure to implement and deploy across your Office 365 platform. Start by having the conversation with your end users and allow them to gain the understanding of why this level of security is necessary and what you can do to support them through this process. You’ll have better user adoption by providing context to the changes that will be occurring.
​
Multi-Factor Authentication Deployment Strategy

​All successful deployments come from having a good plan or strategy.  Here are a couple tasks to include in your strategy to ensure a successful deployment:

1. Get user buy-in by providing context to the upcoming changes. Trust that your audience cares enough about the work your company does to protect it. Provide your users with an open forum to voice feedback and offer articles or additional information on multi-factor authentication. It’s important to spend time on this step to show effort in preparing your audience for the upcoming change.  
   
   
2. Don’t skip over the painful details. At times, what is best may not be the most comfortable option. Acknowledge the manual effort added to the typical authentication process and offer reasons why this is for the best. Not everyone will want an extra app on their phone, or it may feel like a lot of trouble for the company to become more secure. Lack of knowledge and understanding will feed into this stress. Have open conversations with your users about MFA.
   
   
3. Take it one step at a time, don’t rush. Companies may be tempted to flip the switch for multi-factor authentication overnight, but this may not be what is best for your users. Keep in mind that a change is change, regardless of its complexity. In some cases, if you’ve prepped your audience ahead of time then enabling MFA overnight may not end horribly. However, a phased approach may be preferred to offer transition with a slower approach.  Take the approach that best suits your business based on how they react to change.

If you are interested in learning more about multi-factor authentication, here is additional official Microsoft documentation. The article contains instructions to enable MFA for your organization as well. If you’d like a walkthrough of MFA in your own tenant, contact Pivotal Consulting to get started. There is always more to learn about security, and we’d love to partner with you to provide context and assistance to a complex topic.