Skip to content
Limited-time offer: Free external security assessment with your Buyer's Guide. Get the Guide
Business Technologies NI
Security Update

Microsoft is enforcing MFA: what changes for your business, and are passkeys worth it?

Microsoft now requires multi-factor authentication for its admin portals and Azure tools. What that means for a small business, how the MFA methods compare, why passkeys are the phishing-resistant option, and what Conditional Access costs.

7 min readBy , Business Technology Engineer · Updated

Since October 2024 Microsoft has required multi-factor authentication (MFA) for every account that signs in to the Azure portal, the Microsoft Entra admin centre or the Intune admin centre, extended it to the Microsoft 365 admin centre from February 2025, and from 1 October 2025 began enforcing it for Azure command-line tools, PowerShell and APIs; there is no way to opt out, and the option to postpone has now expired 1Source 1Planning for mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, updated 6 October 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authenticationAccessed 3 November 2026See in Sources. For a small business that means every administrator account must have MFA, and in practice every user should, because Microsoft's research shows MFA blocks more than 99.2% of account compromise attacks 1Source 1Planning for mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, updated 6 October 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authenticationAccessed 3 November 2026See in Sources. The next question is which kind. Passkeys, including the FIDO2 security keys and the passkeys in Microsoft Authenticator, are the phishing-resistant option and the one the NCSC rates among the most secure and usable 2Source 2Passkeys (FIDO2) authentication in Microsoft Entra ID — Microsoft Learn, updated 15 June 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2Accessed 3 November 2026See in Sources3Source 3Multi-factor authentication for your corporate online services: recommended types of MFA — National Cyber Security Centre (NCSC), reviewed 26 September 2024.www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfaAccessed 3 November 2026See in Sources; SMS codes are better than nothing but the weakest choice 4Source 4Cyber Essentials: Requirements for IT Infrastructure v3.3 — National Cyber Security Centre (NCSC), April 2026.www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdfAccessed 3 November 2026See in Sources. Rules about who must use what, where, are set with Conditional Access, which comes with Microsoft 365 Business Premium 5Source 5What is Conditional Access? — Microsoft Learn, 27 April 2026.learn.microsoft.com/en-us/entra/identity/conditional-access/overviewAccessed 3 November 2026See in Sources.

The short version

What exactly is Microsoft enforcing, and when?

Microsoft's mandatory MFA rollout (Microsoft Learn, read 3 November 2026)
PhaseWhat it coversFromStatus
Phase 1Sign-in to the Azure portal, Microsoft Entra admin centre and Intune admin centre, for any create, read, update or delete actionOctober 2024Enforced; the postponement option ended 30 September 2025 1Source 1Planning for mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, updated 6 October 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authenticationAccessed 3 November 2026See in Sources
Microsoft 365 admin centreSign-in to admin.microsoft.com and the admin portalFebruary 2025, phased by tenantEnforced 1Source 1Planning for mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, updated 6 October 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authenticationAccessed 3 November 2026See in Sources9Source 9Microsoft will require MFA to access the Microsoft 365 admin center — Microsoft Tech Community, updated 6 January 2026.techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-will-require-mfa-to-access-the-microsoft-365-admin/ba-p/4232568Accessed 3 November 2026See in Sources
Phase 2Azure CLI, Azure PowerShell, the Azure mobile app, infrastructure-as-code tools and REST APIs, for create, update and delete actions1 October 2025, graduallyEnforcing; the option to postpone ended 1 July 2026. A Global Administrator can ask Microsoft Support to lift it temporarily 1Source 1Planning for mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, updated 6 October 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authenticationAccessed 3 November 2026See in Sources

The enforcement applies to people, not to automation: managed identities and service principals are not affected by either phase, so scripts that still run under a named user account are the ones that break 1Source 1Planning for mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, updated 6 October 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authenticationAccessed 3 November 2026See in Sources. Microsoft says plainly that there is no way to opt out 1Source 1Planning for mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, updated 6 October 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authenticationAccessed 3 November 2026See in Sources.

What does this mean for a small business?

If your IT provider or an in-house administrator signs in to any Microsoft admin portal, that account already needs MFA, or it can't do its job. The sensible response is to go further than the minimum and require MFA for every user, which is what Microsoft's free security defaults do: all users must register for MFA, administrators must use it, users are prompted when necessary, legacy authentication protocols are blocked, and since 1 July 2026 new tenants also block device-code sign-in 8Source 8Security defaults in Microsoft Entra ID — Microsoft Learn, updated 16 October 2026.learn.microsoft.com/en-us/entra/fundamentals/security-defaultsAccessed 3 November 2026See in Sources. Security defaults are on by default for new tenants and need no licence 8Source 8Security defaults in Microsoft Entra ID — Microsoft Learn, updated 16 October 2026.learn.microsoft.com/en-us/entra/fundamentals/security-defaultsAccessed 3 November 2026See in Sources.

Two external standards now expect it too. The Cyber Essentials requirements (version 3.3, April 2026) say authentication to cloud services must always use MFA where it is available, and treat FIDO2 passwordless sign-in as MFA 4Source 4Cyber Essentials: Requirements for IT Infrastructure v3.3 — National Cyber Security Centre (NCSC), April 2026.www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdfAccessed 3 November 2026See in Sources. Cyber insurers have moved the same way: UK brokers report that most insurers will now decline a business without MFA on email, remote access and admin accounts rather than price it higher 10Source 10MFA used to be a nice-to-have. Now insurers just say no without it — Insurance Business UK, 12 August 2026 (trade press, quoting UK brokers).www.insurancebusinessmag.com/uk/news/cyber/mfa-used-to-be-a-nicetohave--now-insurers-just-say-no-without-it-585827.aspxAccessed 3 November 2026See in Sources.

Which MFA method should you use: Authenticator, passkeys or SMS?

MFA methods compared for a small business
MethodHow it worksResists phishing?Cost and effortBest for
SMS or voice codeA one-time code texted or read out to your phoneNo: the code can be relayed by a fake sign-in page, and SIM-swap attacks target it. The NCSC says message-based methods are only likely to be appropriate when nothing else is possible 3Source 3Multi-factor authentication for your corporate online services: recommended types of MFA — National Cyber Security Centre (NCSC), reviewed 26 September 2024.www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfaAccessed 3 November 2026See in SourcesFree; nothing to installA fallback, not a default
Authenticator app push with number matchingApprove a prompt on your phone by typing the number shown on screenPartly: number matching defeats "MFA fatigue" prompt-bombing, but a real-time phishing site can still relay the approval 7Source 7How number matching works in multifactor authentication push notifications for Authenticator — Microsoft Learn, updated 21 October 2026.learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-matchAccessed 3 November 2026See in Sources8Source 8Security defaults in Microsoft Entra ID — Microsoft Learn, updated 16 October 2026.learn.microsoft.com/en-us/entra/fundamentals/security-defaultsAccessed 3 November 2026See in SourcesFree; install the app and scan a codeThe default for most staff
Passkey in Microsoft Authenticator (device-bound)A cryptographic key stored on the phone, unlocked by face, fingerprint or PINYes: the key only works on the genuine site 2Source 2Passkeys (FIDO2) authentication in Microsoft Entra ID — Microsoft Learn, updated 15 June 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2Accessed 3 November 2026See in SourcesFree with the app; a Temporary Access Pass gets each user started 11Source 11Configure Temporary Access Pass to register passwordless authentication methods — Microsoft Learn, 4 March 2026.learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-passAccessed 3 November 2026See in SourcesEveryone who can carry a phone; the upgrade for admins and finance
FIDO2 security keyA USB or NFC key you touch to sign inYes: Microsoft recommends it for highly regulated industries and users with elevated privileges 2Source 2Passkeys (FIDO2) authentication in Microsoft Entra ID — Microsoft Learn, updated 15 June 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2Accessed 3 November 2026See in SourcesAbout £30 to £60 including VAT per key 12Source 12Yubico UK store: Security Key NFC and YubiKey 5 NFC (prices including VAT) — Yubico.www.yubico.com/gb/store/Accessed 3 November 2026See in SourcesAdministrators, shared or phone-free roles, high-risk staff
Windows Hello for BusinessFace, fingerprint or PIN on a managed Windows PCYes: listed by Microsoft as phishing-resistant 13Source 13Overview of Microsoft Entra authentication strength — Microsoft Learn, updated 26 June 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengthsAccessed 3 November 2026See in SourcesFree on managed Windows 11 devicesOffice staff on company laptops

Microsoft's own data on passkeys is striking: 99% of users register a synced passkey successfully, sign-in success is 95% against 30% for password plus traditional MFA, and it takes about 3 seconds instead of 69 2Source 2Passkeys (FIDO2) authentication in Microsoft Entra ID — Microsoft Learn, updated 15 June 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2Accessed 3 November 2026See in Sources. The NCSC agrees on the security: "FIDO2 authentication is one of the most secure, yet usable methods of MFA", providing guessing, phishing and theft resistance 3Source 3Multi-factor authentication for your corporate online services: recommended types of MFA — National Cyber Security Centre (NCSC), reviewed 26 September 2024.www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfaAccessed 3 November 2026See in Sources. Microsoft has argued since 2020 that phone-based codes are the least secure MFA method available 14Source 14It's time to hang up on phone transports for authentication — Microsoft Entra blog, 10 November 2020.techcommunity.microsoft.com/blog/microsoft-entra-blog/its-time-to-hang-up-on-phone-transports-for-authentication/1751752Accessed 3 November 2026See in Sources.

Are passkeys worth it for a small business?

For administrators, finance staff and directors, yes, and the cost is close to nothing: a passkey in Microsoft Authenticator is free, and a hardware key is £30 to £60 including VAT 12Source 12Yubico UK store: Security Key NFC and YubiKey 5 NFC (prices including VAT) — Yubico.www.yubico.com/gb/store/Accessed 3 November 2026See in Sources. For everyone else, an Authenticator push with number matching is a reasonable baseline today, with passkeys rolled out as devices are refreshed. Two practical notes. Synced passkeys, stored in Apple iCloud Keychain or Google Password Manager, are convenient but if you turn on attestation in Entra only device-bound passkeys are allowed 2Source 2Passkeys (FIDO2) authentication in Microsoft Entra ID — Microsoft Learn, updated 15 June 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2Accessed 3 November 2026See in Sources. And keep two methods registered per person, so a lost phone is an inconvenience rather than a lock-out.

What is Conditional Access, and what does it cost?

Conditional Access policies are, in Microsoft's words, if-then statements: if a user wants to access a resource, then they must complete an action 5Source 5What is Conditional Access? — Microsoft Learn, 27 April 2026.learn.microsoft.com/en-us/entra/identity/conditional-access/overviewAccessed 3 November 2026See in Sources. If an administrator signs in, require a phishing-resistant method. If anyone signs in from outside the UK, block it. If a device isn't managed, allow email in the browser only. It is how you move from "MFA is on" to rules that match the risk. It requires a Microsoft Entra ID P1 licence, and customers with Microsoft 365 Business Premium can use it; risk-based policies that react to leaked credentials need P2 5Source 5What is Conditional Access? — Microsoft Learn, 27 April 2026.learn.microsoft.com/en-us/entra/identity/conditional-access/overviewAccessed 3 November 2026See in Sources.

What each Microsoft 365 business plan gives you for identity (Microsoft UK list prices, annual commitment, ex VAT, read 3 November 2026)
PlanPrice per user per monthIdentity features
Business Basic£5.40Security defaults (MFA for all, legacy authentication blocked); core identity and access management 8Source 8Security defaults in Microsoft Entra ID — Microsoft Learn, updated 16 October 2026.learn.microsoft.com/en-us/entra/fundamentals/security-defaultsAccessed 3 November 2026See in Sources15Source 15Microsoft 365 Business Premium (plan page and UK list price, ex VAT, annual commitment) — Microsoft UK.www.microsoft.com/en-gb/microsoft-365/business/microsoft-365-business-premiumAccessed 3 November 2026See in Sources
Business Standard£10.80The same core identity features 15Source 15Microsoft 365 Business Premium (plan page and UK list price, ex VAT, annual commitment) — Microsoft UK.www.microsoft.com/en-gb/microsoft-365/business/microsoft-365-business-premiumAccessed 3 November 2026See in Sources
Business Premium£16.90Adds policy-based identity and access management: Conditional Access (Entra ID P1), plus Intune device management and Defender for Business 5Source 5What is Conditional Access? — Microsoft Learn, 27 April 2026.learn.microsoft.com/en-us/entra/identity/conditional-access/overviewAccessed 3 November 2026See in Sources15Source 15Microsoft 365 Business Premium (plan page and UK list price, ex VAT, annual commitment) — Microsoft UK.www.microsoft.com/en-gb/microsoft-365/business/microsoft-365-business-premiumAccessed 3 November 2026See in Sources

Our guide to Microsoft 365 Business Premium sets out everything the licence includes and maps it to the five Cyber Essentials controls.

How should you roll MFA out without chaos?

  1. 1.Start with administrators and break-glass accounts: passkeys or hardware keys, and two of them.
  2. 2.Turn on security defaults if you have no Conditional Access licence; otherwise build three policies: require MFA for all users, require phishing-resistant MFA for admins, and block legacy authentication 5Source 5What is Conditional Access? — Microsoft Learn, 27 April 2026.learn.microsoft.com/en-us/entra/identity/conditional-access/overviewAccessed 3 November 2026See in Sources8Source 8Security defaults in Microsoft Entra ID — Microsoft Learn, updated 16 October 2026.learn.microsoft.com/en-us/entra/fundamentals/security-defaultsAccessed 3 November 2026See in Sources.
  3. 3.Tell staff a week ahead, with a one-page guide and the Authenticator app link. Use Temporary Access Passes for anyone setting up a passkey without a password 11Source 11Configure Temporary Access Pass to register passwordless authentication methods — Microsoft Learn, 4 March 2026.learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-passAccessed 3 November 2026See in Sources.
  4. 4.Find the scripts, scanners and line-of-business apps signing in as a user, and move them to service principals or app passwords before Phase 2 enforcement breaks them 1Source 1Planning for mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, updated 6 October 2026.learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authenticationAccessed 3 November 2026See in Sources.
  5. 5.Register a second method for everyone, and agree a helpdesk process for lost phones that doesn't involve turning MFA off.

How does BTNI handle MFA?

MFA for every user, phishing-resistant methods for administrators and Conditional Access policies are standard in BTNI's Microsoft 365 and Cybersecurity services, with the roll-out run for you and the exceptions chased. A free Business Technology Review shows which of your accounts still sign in with a password alone.

Sources

  1. 1.Planning for mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, updated 6 October 2026.↩https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication — accessed 3 November 2026
  2. 2.Passkeys (FIDO2) authentication in Microsoft Entra ID — Microsoft Learn, updated 15 June 2026.↩https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2 — accessed 3 November 2026
  3. 3.Multi-factor authentication for your corporate online services: recommended types of MFA — National Cyber Security Centre (NCSC), reviewed 26 September 2024.↩https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfa — accessed 3 November 2026
  4. 4.Cyber Essentials: Requirements for IT Infrastructure v3.3 — National Cyber Security Centre (NCSC), April 2026.↩https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf — accessed 3 November 2026
  5. 5.What is Conditional Access? — Microsoft Learn, 27 April 2026.↩https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview — accessed 3 November 2026
  6. 6.Cyber security breaches survey 2025/2026 — Department for Science, Innovation and Technology (official statistics), 30 April 2026.↩https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 — accessed 3 November 2026
  7. 7.How number matching works in multifactor authentication push notifications for Authenticator — Microsoft Learn, updated 21 October 2026.↩https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match — accessed 3 November 2026
  8. 8.Security defaults in Microsoft Entra ID — Microsoft Learn, updated 16 October 2026.↩https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults — accessed 3 November 2026
  9. 9.Microsoft will require MFA to access the Microsoft 365 admin center — Microsoft Tech Community, updated 6 January 2026.↩https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-will-require-mfa-to-access-the-microsoft-365-admin/ba-p/4232568 — accessed 3 November 2026
  10. 10.MFA used to be a nice-to-have. Now insurers just say no without it — Insurance Business UK, 12 August 2026 (trade press, quoting UK brokers).↩https://www.insurancebusinessmag.com/uk/news/cyber/mfa-used-to-be-a-nicetohave--now-insurers-just-say-no-without-it-585827.aspx — accessed 3 November 2026
  11. 11.Configure Temporary Access Pass to register passwordless authentication methods — Microsoft Learn, 4 March 2026.↩https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass — accessed 3 November 2026
  12. 12.Yubico UK store: Security Key NFC and YubiKey 5 NFC (prices including VAT) — Yubico.↩https://www.yubico.com/gb/store/ — accessed 3 November 2026
  13. 13.Overview of Microsoft Entra authentication strength — Microsoft Learn, updated 26 June 2026.↩https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths — accessed 3 November 2026
  14. 14.It's time to hang up on phone transports for authentication — Microsoft Entra blog, 10 November 2020.↩https://techcommunity.microsoft.com/blog/microsoft-entra-blog/its-time-to-hang-up-on-phone-transports-for-authentication/1751752 — accessed 3 November 2026
  15. 15.Microsoft 365 Business Premium (plan page and UK list price, ex VAT, annual commitment) — Microsoft UK.↩https://www.microsoft.com/en-gb/microsoft-365/business/microsoft-365-business-premium — accessed 3 November 2026

See where your business stands

A Business Technology Review turns these ideas into a clear, prioritised plan for your business.

Book Your Business Technology Review
Or start smaller: Discover Your TechState™ Index
Questions & answers

Quick answers

For administrators, yes: Microsoft requires MFA to sign in to the Azure portal, Entra and Intune admin centres and the Microsoft 365 admin centre, and since 1 October 2025 has been enforcing it for Azure command-line tools and APIs, with no opt-out. For ordinary users it is enforced only if you turn on security defaults or a Conditional Access policy, which you should.

Keep reading

Article6 min read

What does Microsoft 365 Business Premium include, and does a small business in Northern Ireland need it?

What Business Premium adds over Basic and Standard, how its security tools line up with the five Cyber Essentials controls, and when it's worth paying for.

Read
Article7 min read

Cyber Essentials vs Cyber Essentials Plus: which does your business need?

The difference between Cyber Essentials and Cyber Essentials Plus, what each costs at 2026 fees and UK market prices, who asks for which, how long they take, and how to decide.

Read
Article6 min read

How do you back up Microsoft 365, and how often should you test a restore?

Why Microsoft 365's recycle bins and retention aren't a backup, what NCSC guidance says about ransomware-resistant backups, and a practical restore-test checklist.

Read
Your next step to TechState™

Ready to run your business on its technology?

Book your Business Technology Review. In one focused conversation, we'll understand your business, assess your platform and show you the path to operating in TechState™.

Book Your Business Technology ReviewDiscover Your TechState™ Index