The Truth About MFA: Why It Wasn't Enough for This Small Business

Updated August 2026: I originally wrote this article in 2025 after helping a small business recover from a compromised Microsoft 365 account. One of the things that made the incident stand out was that the company already had two factor authentication enabled, so from the owner's perspective, an important security control was already in place. Since then, Microsoft's approach to authentication has changed considerably. Passkeys have become a much bigger part of Microsoft Entra ID, Microsoft is actively moving organizations toward phishing resistant authentication, and Microsoft provided SMS and voice authentication is approaching retirement. I decided this article needed more than a few updated sentences because the question small business owners should be asking has changed. Instead of simply asking, “Do we have MFA?”, I think businesses also need to ask, “What authentication methods are we actually using, and are they appropriate for the accounts we are protecting?”

MFA for small business is often discussed as though it is one security control that provides the same protection regardless of how it is implemented. It does not. A text message, a push notification, a one time code, Windows Hello for Business, a passkey, and a physical FIDO2 security key are different authentication methods with different characteristics. MFA remains an important security control, but today I want to know much more than whether a Microsoft 365 portal says it is enabled.

The Microsoft 365 Compromise That Started This Conversation

The original reason I wrote this article was a call from a small business owner whose customers were receiving strange file sharing messages that appeared to be coming from company email accounts. The messages looked like legitimate Dropbox or OneDrive sharing notifications, but they were not. When I investigated, I determined that one of the company's Microsoft 365 accounts had been compromised even though the business already had two factor authentication enabled.

Once inside the mailbox, the attacker had created inbox rules, hidden replies, forwarded messages, and used the account to send malicious links to the company's contacts. At that point, this was no longer just an employee password problem. The attacker had access to a legitimate business mailbox and could use the company's existing identity and relationships to make malicious messages more believable. For a small business, that can quickly turn one compromised account into a much larger problem involving employees, customers, vendors, and anyone else accustomed to trusting messages from that company.

One thing I would explain differently today is how the attacker got through the authentication process. I know the account was compromised despite the company having two factor authentication enabled, but I do not know exactly which technique the attacker used. I am not going to fill that gap by guessing whether an employee approved a fraudulent request, entered information into a phishing site, or whether another attack method was involved. What I knew at the time was enough to make me look beyond whether MFA was turned on and start examining the authentication methods, access policies, email configuration, and surrounding Microsoft 365 environment.

2FA, MFA, and Phishing Resistant Authentication Are Not the Same Thing

Two factor authentication, commonly called 2FA, means that two authentication factors are involved. Multifactor authentication, or MFA, is the broader term Microsoft generally uses when discussing authentication involving more than one form of verification. In normal small business conversations, people often use the terms interchangeably, and I do not think arguing over the terminology helps an owner protect the business. What matters much more today is which authentication method employees and administrators are actually using.

Traditional MFA made account compromise considerably harder because stealing a password was no longer necessarily enough to gain access. I still want MFA protections in place, but attackers have adapted, and some authentication methods remain susceptible to phishing, social engineering, adversary in the middle attacks, and other techniques. That is why Microsoft's current security direction increasingly emphasizes phishing resistant authentication, including passkeys and other FIDO2 based methods.

For a business owner, I think the easiest way to understand the difference is to look at what the user is actually doing during authentication.

Authentication method	What the user does	What I want an owner to understand
SMS or voice	Receives a code or call	Better than relying on a password alone, but Microsoft is retiring its own SMS and voice delivery and moving users toward phishing resistant methods.
Authenticator based MFA	Approves or completes authentication through an authenticator	Can provide stronger protection than SMS depending on the method and configuration, but not every authenticator based method is phishing resistant.
Passkey	Uses a registered device or credential provider and verifies locally with a PIN, fingerprint, face, or other supported method	The credential is tied to the legitimate service, which makes it resistant to traditional credential phishing.
FIDO2 security key	Uses a physical hardware authenticator and completes local verification	A device bound phishing resistant option that can be especially useful for privileged or sensitive accounts.
Windows Hello for Business	Uses the enrolled Windows device with a PIN or biometric	A phishing resistant authentication method designed for managed Windows environments.

I would not use this table to decide that every employee needs the strongest looking option in the last row. Authentication still has to fit the environment, the users, the devices they work from, and the accounts they need to access. What the table demonstrates is why asking only whether MFA is enabled no longer tells me enough about how a Microsoft 365 environment is protected.

What Makes a Passkey Different?

A passkey changes the authentication process rather than simply adding another code after a password. Passkeys use public key cryptography, with a private key protected by the user's device or credential provider and a corresponding public key registered with the service. The user does not have a reusable secret that needs to be typed into a Microsoft login form every time they authenticate.

The important part for a small business owner is that the passkey is bound to the legitimate website or application for which it was created. If an employee lands on a fake Microsoft login page, there is not simply a passkey code sitting there that the employee can copy into the attacker's site. The credential works with the legitimate service it was registered for, and the user authorizes its use locally through an appropriate method such as a PIN, fingerprint, facial recognition, supported credential provider, or physical security key.

That is why I would not describe a passkey as simply a stronger version of a text message code. It changes an important part of the authentication process and removes the reusable password from that particular sign in flow. Passkeys do not eliminate every way an account, device, application, or session could potentially be attacked, but they are designed to address some of the weaknesses that make passwords and traditional authentication methods attractive phishing targets.

Why Microsoft Is Moving Businesses Toward Passkeys

This article is being refreshed at an important point in Microsoft's authentication roadmap. Beginning September 1, 2026, Microsoft says users who are enabled for SMS or voice authentication will automatically be enabled for passkeys and nudged toward passkey registration. Organizations can temporarily opt out of that automatic transition during the migration period, but Microsoft's direction is clear.

Beginning February 1, 2027, Microsoft plans to retire Microsoft provided SMS and voice authentication delivery in Microsoft Entra ID. Businesses with a legitimate operational or other need to continue using SMS or voice will have an option to use a customer managed telecommunications provider, but Microsoft recommends moving users to phishing resistant methods such as passkeys, Windows Hello for Business, or FIDO2 security keys.

After the February deadline, users whose only available MFA method is Microsoft provided SMS or voice and who have not been moved to another supported option will be required to register a passkey to continue signing in.

For small businesses, I would not treat this as something to worry about in January 2027. If employees still rely on text messages or voice calls for Microsoft 365 authentication, now is the time to determine who is using those methods and plan the transition intentionally. I would rather work through device compatibility, employee registration, administrator accounts, recovery options, and authentication policies ahead of time than have employees encounter a change during sign in without anyone responsible for the Microsoft 365 environment knowing why it is happening.

Not Every Passkey Works the Same Way

Passkeys are also more nuanced than simply turning on a setting labeled Passkey. Microsoft Entra ID currently supports both synced passkeys and device bound passkeys. A synced passkey can be stored through a supported credential provider and made available across the user's devices, while a device bound passkey remains associated with the particular device or authenticator where it was created.

That distinction gives businesses choices. Synced passkeys can make deployment and recovery easier for regular employees because users may already have supported credential providers available across their devices. Device bound passkeys, including physical FIDO2 security keys and supported Microsoft Authenticator passkeys, provide tighter control because the credential remains with a particular authenticator. Microsoft currently recommends device bound passkeys for administrators and highly privileged users, while describing synced passkeys as an option appropriate for many nonadministrator users.

I would not turn that recommendation into a blanket rule for every small business I support. The right choice depends on the user's role, the sensitivity of the account, the devices being used, how the business handles recovery, and how much administrative control is appropriate. The useful part is that I now have several phishing resistant authentication options available instead of trying to make one method fit every employee and every account.

What I Did After the Microsoft 365 Account Was Compromised

My work for this client did not stop with changing the employee's password. I reset the appropriate credentials, removed malicious inbox rules, checked for forwarding that should not have been there, and reviewed the account after the compromise. I also worked on the company's domain and email security configuration because protecting a Microsoft 365 account from unauthorized access and protecting a company's email identity from spoofing are related security concerns, but they are not the same problem.

From there, I started looking at how to make authentication stronger going forward. I began introducing passkeys for key employees and working through how stronger authentication could fit the company's devices and normal workflow. I did not want the lesson from the incident to be that we simply needed another password or another prompt. The company already had two factor authentication when the compromise happened, so I wanted to understand what additional controls made sense around the way the business actually used Microsoft 365.

Since that original project, I have continued using stronger authentication methods in the Microsoft 365 environments I manage where they are appropriate. That includes passkeys and, for certain privileged or emergency access scenarios, physical FIDO2 security keys. I do not treat those as interchangeable solutions or assume every employee needs a physical security key. My approach is to look at the account, the user's role, the devices involved, and what we need to be able to recover if an authentication device is lost or unavailable.

MFA Is One Layer of Microsoft 365 Security

The growing attention around passkeys can make it tempting to treat stronger authentication as the solution to Microsoft 365 security, but I do not look at a tenant that way. A phishing resistant passkey can make it significantly harder to steal an employee's authentication credential through phishing, but it does not configure the company's email authentication, determine whether unmanaged devices should have access to company information, review administrator roles, monitor Microsoft security alerts, manage SharePoint permissions, remove former employees, or protect the company's Microsoft 365 data with an appropriate recovery strategy.

Conditional Access is one of the tools I use to connect authentication to the larger environment when the client's Microsoft Entra licensing supports it. Depending on the business and the policy being implemented, Conditional Access can evaluate conditions around a sign in and control what is required before access is granted. Microsoft Entra authentication strengths can also be used with Conditional Access to require particular categories of authentication, including phishing resistant MFA, instead of treating every method that technically satisfies MFA as equivalent.

This becomes especially important for privileged administrator accounts because those accounts can change settings and access resources that a standard employee cannot. Microsoft recommends phishing- resistant MFA for privileged administrative roles, and I agree with the underlying principle of protecting privileged access more carefully. Exactly how I implement that still depends on the environment, and I also plan emergency access before enforcing policies that could potentially lock administrators out.

I go deeper into those broader controls in Microsoft 365 Tenant Security Review: What I Look for During a Microsoft 365 Audit. Authentication is an important part of my Microsoft 365 Audit, but I review it alongside administrative access, Conditional Access, licensing, Microsoft Defender, devices, SharePoint, OneDrive, third-party applications, backup and recovery, monitoring, and documentation.

Account Compromise and Email Spoofing Are Different Problems

One distinction I think small business owners should understand is the difference between an account being compromised and an email address being spoofed. If an attacker actually authenticates to an employee's Microsoft 365 account, they may be able to work from inside a legitimate mailbox. Authentication controls, Conditional Access, identity security, monitoring, and incident response are important parts of reducing that risk and responding when it happens.

Email spoofing is different because an attacker may attempt to make a message appear to come from a company or domain without ever successfully signing into the employee's Microsoft 365 account. That brings controls such as SPF, DKIM, DMARC, anti-phishing policies, and impersonation protection into the discussion. Stronger authentication does not eliminate the need to secure the company's email identity, just as properly configuring DMARC does not replace the need to secure employee accounts.

I have dealt with that problem from the other side with a law firm whose domain was being impersonated. I explain what happened and the email-specific controls involved in Microsoft 365 Email Security for Law Firms: How One Law Firm Got Spoofed and What I Did to Fix It. Although that article focuses on a law firm, the distinction between protecting a user's authentication and protecting the company's email identity applies to small businesses in any industry.

Should Every Employee Use a Physical Security Key?

No. A physical FIDO2 security key can be an excellent phishing-resistant authentication option, particularly when I want a device-bound credential for a privileged or sensitive account. Microsoft now supports multiple types of passkeys and other phishing-resistant authentication methods, however, I would not tell a small business to purchase hardware keys for every employee simply because they provide strong authentication.

I also want account recovery considered before stronger authentication is enforced. If a laptop, phone, or physical key is lost, damaged, replaced, or unavailable, the business needs an established way to recover access without weakening the security we were trying to improve. That planning becomes even more important for Microsoft 365 administrators because losing access to every privileged account can turn an otherwise routine device problem into a much larger issue.

For the businesses I manage, the goal is to use the strongest practical authentication that fits the environment while still having a manageable process for enrollment, employee onboarding, device replacement, offboarding, and recovery. Security controls work much better when they are designed around how the business actually operates instead of being dropped into the environment without a plan.

What Should a Small Business Review Before Microsoft's 2027 Authentication Changes?

I would not start this project by buying hardware or assuming every employee needs the same authentication method. I would start by understanding what is already happening inside Microsoft Entra ID. Someone responsible for the tenant should be able to review the current authentication methods and answer questions such as:

• Which employees are currently using SMS or voice authentication?

• Who is using Microsoft Authenticator or another supported authentication method?

• Are passkeys currently enabled for the organization?

• Which accounts have privileged Microsoft 365 or Microsoft Entra administrator roles?

• What authentication methods protect those privileged accounts?

• Does the business use Conditional Access, and do the existing policies still make sense?

• Are employees accessing Microsoft 365 from managed or unmanaged devices?

• What happens if an employee loses a phone, laptop, or physical security key?

• Are emergency access accounts properly planned and protected?

• Who is responsible for helping employees transition as Microsoft changes its authentication experience?

Those questions are useful even for businesses that are already using stronger authentication. Microsoft 365 is not a static environment, and authentication methods should be reviewed as employees, devices, Microsoft capabilities, and security risks change.

Having MFA and Managing Microsoft 365 Are Two Different Things

This client story is a good example of something I continue seeing in small business environments. Microsoft 365 can appear to be working perfectly from the employee's perspective while important security decisions have never been reviewed. Email works, OneDrive synchronizes, Teams opens, and everybody gets an MFA prompt, so there may be no obvious reason for an owner to think anything needs attention.

That normal day-to-day experience does not tell me whether the authentication methods are appropriate, whether privileged accounts are protected differently, whether Conditional Access policies still match how the company operates, whether former employees have been handled properly, or whether somebody is paying attention to Microsoft's changing security roadmap. Microsoft's current passkey transition illustrates the problem well. A business owner should not have to learn about a major Microsoft authentication change because employees suddenly begin seeing different prompts when they sign in.

I discuss that larger management gap in Microsoft 365 for Small Businesses: Is Anyone Actually Managing Your Environment?. Purchasing Microsoft 365 gives a business access to technology, but someone still needs to configure, review, document, monitor, and update the environment as Microsoft and the business change.

MFA and Passkey Questions Small Business Owners Are Asking

Is MFA still secure?

MFA remains an important security control, but the authentication method matters. Traditional MFA methods can provide meaningful protection compared with relying on a password alone, while phishing-resistant methods such as passkeys are designed to address additional credential phishing risks. I would not recommend removing MFA protections. I would review which authentication methods employees and administrators are actually using and determine whether stronger methods are appropriate.

Is Microsoft getting rid of SMS authentication?

Microsoft plans to retire Microsoft provided SMS and voice authentication delivery in Microsoft Entra ID beginning February 1, 2027. Beginning September 1, 2026, Microsoft will automatically enable passkeys for users currently enabled for SMS or voice and begin nudging those users toward passkey registration. Organizations with a legitimate need to continue using SMS or voice will have the option of using a customer managed telecommunications provider rather than Microsoft's native delivery.

What is a passkey?

A passkey is a phishing-resistant credential based on public key cryptography. The private credential remains protected by the user's device or passkey provider, while the service stores the corresponding public key. Because the credential is tied to the legitimate service and the user verifies locally, a passkey is designed to resist the credential phishing techniques that can capture reusable passwords and authentication codes.

Is a passkey the same as a physical security key?

No. A physical FIDO2 security key is one way to store and use a device-bound passkey, but Microsoft Entra ID also supports other passkey options. These include device bound passkeys in Microsoft Authenticator and synced passkeys through supported providers. The appropriate option depends on the user, account, devices, and level of administrative control the business needs.

Do I still need MFA if I use a passkey?

A passkey can satisfy MFA requirements in Microsoft Entra ID when used with the required local user verification. From a business owner's perspective, the important question is whether the authentication method satisfies the policies and security requirements established for that particular account rather than assuming a passkey is simply another second factor added to a password.

Are passkeys impossible to hack?

No security technology should be described that way. Passkeys are designed to provide strong resistance to credential phishing and eliminate several weaknesses associated with reusable passwords and phishable authentication methods, but they do not eliminate every possible attack against an account, device, application, session, or organization. I still use authentication as one layer within a broader Microsoft 365 security strategy.

Should Microsoft 365 administrators use stronger authentication?

Microsoft recommends phishing-resistant MFA for privileged administrative roles. I agree with protecting privileged accounts more carefully because those accounts can have significantly more control over a Microsoft 365 environment than a standard user. The authentication method, Conditional Access design, backup authentication, and emergency access process should all be planned before those protections are enforced.

Can passkeys stop email spoofing?

No. Passkeys protect authentication. Email spoofing and domain impersonation involve different security controls, including SPF, DKIM, DMARC, anti-phishing policies, and impersonation protection. A business needs to consider both account security and email identity protection.

Stronger Authentication Is Part of a Larger Security Strategy

When I originally wrote this article, I wanted small business owners to understand that turning on two-factor authentication did not mean they could stop thinking about Microsoft 365 account security. I still believe that, but we now have better authentication options and a much clearer direction from Microsoft about where authentication is going. Passkeys and other phishing-resistant methods give businesses an opportunity to move away from some of the weaknesses associated with passwords and traditional MFA without pretending that authentication alone solves every Microsoft 365 security problem.

For me, the useful lesson from this client's experience is not that MFA failed. The business had taken an important security step, but that step was only one part of the environment. The compromise gave me a reason to look deeper at authentication, access, email configuration, and the surrounding Microsoft 365 tenant, and the authentication tools available today give me better options than I had when I originally wrote about the incident.

If your business is still relying heavily on passwords, SMS authentication, or Microsoft 365 security settings that have not been reviewed in years, Microsoft's upcoming authentication changes make this a good time to look at what is actually configured. If you are not sure which authentication methods your employees are using or how those methods fit into the rest of your Microsoft 365 security, SNL Tech Services can review the environment through a Microsoft 365 Audit and help determine what should be updated for the way your business operates.

ADDITIONAL RESOURCES

Microsoft Learn: Passkeys by Default and Retirement of Microsoft Provided SMS and Voice Authentication

Microsoft's August 2026 guidance explains the September 1, 2026 passkey transition, the February 1, 2027 retirement of Microsoft provided SMS and voice authentication, and what organizations should do to prepare.Microsoft Passkey and SMS/Voice Retirement Guidance

Microsoft Learn: Passkeys (FIDO2) Authentication Method in Microsoft Entra ID

Microsoft explains device bound and synced passkeys, phishing resistance, public key authentication, and considerations for choosing an appropriate passkey model.Passkeys in Microsoft Entra ID

Microsoft Learn: Require Phishing Resistant MFA for Microsoft Entra Administrator Roles Microsoft's guidance explains why privileged administrator accounts should use phishing resistant authentication and how authentication strengths can be applied through Conditional Access.Phishing Resistant MFA for Administrators

Microsoft Learn: Passkey Frequently Asked Questions

Microsoft's current FAQ covers synced and device bound passkeys, administrative controls, recovery considerations, and Microsoft's recommendations for administrator and standard user scenarios.Microsoft Entra Passkey FAQ

Microsoft Learn: Microsoft Entra Passkey on Windows

Microsoft explains how device bound passkeys can be stored in the Windows Hello container and how this differs from Windows Hello for Business.Microsoft Entra Passkey on Windows

guide.