Defend
Multi-factor sign-in
A password can be phished, guessed or reused. A second factor is something only the person has, so a stolen password on its own opens nothing.
A stolen password on its own opens nothing.
Attackers rarely crack a file. They sign in, with a password from a phishing mail or one reused somewhere else. Multi-factor sign-in asks for a second proof at the sign-in: a prompt on the person’s phone, a code, a key only they hold. Without it, the password is worthless to whoever stole it. It is the control insurers ask about first. The point is every account: the one without a second factor is the one that gets taken over, and usually it’s a shared mailbox, a former colleague or an admin.
What we set up
Every account, no exceptions, without slowing anyone down.
The second factor is set up in Microsoft Entra ID for every account your firm has, in an order that keeps everyone working.
-
Every account, by name
Every person, every admin, every shared mailbox and every technical account that can sign in. The list of accounts is checked against the list of people, so no account is missed because nobody remembered it.
-
The app, not the text message
The second factor is a prompt in an authenticator app on the person’s phone, or a hardware key where a role calls for it. Codes by text message are the weakest method and are switched off wherever the platform lets us.
-
Admins and leadership first
The accounts attackers want most get the second factor first and the strictest settings: admin roles, the people who decide, the finance mailbox.
-
Rolled out in your rhythm
A pilot group first, then the rest in waves, never on a deadline day. Each person gets a short instruction, and an engineer is there when a phone doesn’t cooperate.
-
Conditional access decides when to ask
On a managed laptop in the office, a normal day asks for nothing extra. The second factor steps in when something doesn’t fit: a new device, a new country, an odd hour. The rules live in conditional access.
-
A lost phone, a new one
A phone lost or replaced is the moment most firms lock someone out or, worse, switch the factor off for them. We have a fixed way to re-enrol a person safely, with their identity checked first, so nobody is tempted to work around it.
On record
In your evidence file.
- Every account with a second factor, and which method it uses
- The accounts without one, each with its reason and its date, if any exist
- When the list was last checked against the people in your firm
- The sign-in report for the day an insurer asks how sign-in is protected
The insurer’s question “Is multi-factor authentication enforced for all users?” gets a yes you can show.
What usually goes wrong without it.
-
For most, not for all
The second factor is on for the people who were there when it was rolled out. The shared mailbox, the former colleague’s account and the admin made “just for now” never got it, and one of them is the way in.
-
Switched off after one complaint
Someone finds the prompt annoying, or loses a phone on a Friday, and the factor is switched off for them. It is rarely switched back on.
-
The questionnaire answered from memory
“Yes, we have MFA” on the insurer’s form, and nobody checked the list. If a claim comes, the insurer does.
Also under Defend
- Email security Spam, phishing and malware filtered out before a mail reaches anyone, with long-term archiving.
- Conditional access Who is signing in, from where and on which device, checked every time.
- Device protection Managed protection and threat detection on every laptop, workstation and server, to a documented baseline.
- Patching and vulnerability management Updates rolled out from one place, and the gaps that remain found and closed.
- Admin access Admin rights for few, by name; passwords in a vault; every use logged. Our own keys first.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Security monitoring Devices, sign-ins and systems watched centrally; what the monitoring found, reviewed by our engineers, and what we changed.
- Access reviews Who can open what, reviewed with you, so access that made sense last year doesn’t quietly stay.
- Incident response When someone clicks, or a server shows a ransom note: the same sequence every time, ending in the record.
- The evidence file What protects your firm, written down as it is, ready on the day an insurer, a client or an auditor asks.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
- Changing provider The old provider’s software and access removed, with a written check that nobody keeps a way in.
Questions we get
Does every sign-in now need my phone?
No. On a managed device in a place you work from, a normal working day asks for nothing extra. The second factor is asked for when something doesn’t fit, and when a person signs in on a new device.
What happens when someone loses their phone?
They tell us, we check who they are, and we re-enrol them on the new phone. The old one is removed from their account. Nobody gets the factor switched off to save time.
What about accounts that aren’t people: shared mailboxes, scanners, the booking system?
They get a second factor too, or they lose the ability to sign in at all and get a narrower way to do their job. An account that can sign in with a password alone is the one an attacker looks for.
Can you prove to our insurer that it’s enforced for everyone?
Yes. The list of accounts with their second factor, any exceptions with their reasons and dates, and the date of the last check are in your evidence file.
Start
Which of your accounts could be opened with a password alone?
In a first call we go through every kind of account your firm has, which ones have a second factor today, and how the rest would get one without stopping anyone’s work.
- No first level
- No surprises
- Pilot before you buy