Microsoft increases account security

Microsoft has announced that it will enforce multi-factor authentication (MFA) on all Microsoft and 365 accounts. This includes accounts that have been previously running without MFA. MFA adds an additional layer of security, such as one-time code from an app, as well as your username and password to ensure the correct individual is signing in. MFA is now becoming the norm across the IT industry.

What does it mean for me?

If you're currently using MFA you won't see any change, however, accounts without it will see a series of messages that will ultimately force the user to adopt MFA. "Using a one-time code is very easy or the Microsoft Authentication app allows you to sign in by simply confirming your log in," explains Chris Joberns, Managing Director at Strident. "If users don't want to use an app, they can use text, phone calls or email as well."

Why is Microsoft doing this?

Alex Weinert, Director of Identity Security at Microsoft explains that "when we look at hacked accounts, more than 99.9% don't have MFA, making them vulnerable to password spray, phishing, and password reuse.

"We introduced security defaults in October 2019 for new [customers]. These organisations experience 80 percent less compromise than the overall [customer] population. We are delighted with the success of this program, but [customers] created before October 2019 were not included in security defaults and were vulnerable unless they explicitly enabled features like Conditional Access, Identity Protection, and MFA. Many organisations aren't even aware of these capabilities – or the increasingly dangerous wave of attacks they prevent. That's why we're so excited to announce the rollout of security defaults to existing tenants, targeting those who haven't changed any security settings since deployment."

Sounds complicated, can you help me?

Yes, if your business has more than five Windows PCs in regular use then you can benefit from our professional IT support for small businesses. To discuss MFA and securing your IT systems, contract Strident on 01473 835 280.