Stop Password Chaos: A Guide to Microsoft Authenticator and Multi-Factor Authentication for Small Business

Summary

This guide helps you troubleshoot and resolve: Stop Password Chaos: A Guide to Microsoft Authenticator and Multi-Factor Authentication for Small Business. Follow the steps below to fix the issue.

Common Causes

Multi-Factor Authentication (MFA) adds a critical second layer of security to your Microsoft 365 accounts. Even if a password is compromised, an attacker cannot sign in without the additional verification step provided by Microsoft Authenticator. For Australian small businesses, enabling MFA is often a mandatory requirement for cyber insurance policies and compliance audits. This guide walks you through setting up Microsoft Authenticator and enforcing MFA across your organisation.

Quick Fix Steps

1. Download Microsoft Authenticator from the Apple App Store or Google Play Store.
2. Sign in to your Microsoft 365 admin centre at admin.microsoft.com.
3. Enable security defaults or configure conditional access policies.
4. Have each user register their device via the Microsoft Authenticator app.
5. Verify that MFA is enforced for all administrative and user accounts.

Detailed Instructions

1. Install Microsoft Authenticator

Ask every team member to install Microsoft Authenticator on their mobile device before you enforce MFA.

• iPhone users: Open the App Store, search for Microsoft Authenticator, and tap Get.
• Android users: Open the Google Play Store, search for Microsoft Authenticator, and tap Install.

2. Sign in to the Microsoft 365 Admin Centre

1. Go to https://admin.microsoft.com and sign in with your global administrator account.
2. In the left-hand navigation menu, select Users, then choose Active users.
3. Click the Multi-factor authentication link in the top ribbon.

3. Enable Security Defaults (Recommended for Small Business)

Security defaults is the fastest way to enforce MFA across your entire organisation without configuring individual policies.

1. In the Microsoft 365 admin centre, go to Azure Active Directory > Properties.
2. At the bottom of the page, click Manage security defaults.
3. Set Enable security defaults to Yes.
4. Click Save.

4. Have Users Register Their Devices

Once security defaults are enabled, each user must complete the registration process the next time they sign in.

1. The user signs in to office.com with their work email and password.
2. A prompt appears stating More information required. Click Next.
3. Select Mobile app as the method, then choose Receive notifications for verification.
4. Click Set up. A QR code will appear on screen.
5. Open Microsoft Authenticator on the mobile device, tap the + icon, select Work or school account, and scan the QR code.
6. Click Next in the browser and approve the test notification sent to the mobile device.
7. Complete the setup by adding a phone number as a backup authentication method.

5. Enforce MFA for All Accounts

1. Return to Users > Active users > Multi-factor authentication.
2. Select all users in the list.
3. In the right-hand panel, under Quick steps, click Enable.
4. Confirm the action in the pop-up dialog.

Troubleshooting

User Did Not Receive the MFA Prompt

• Ensure security defaults are enabled in the Azure AD Properties blade.
• Ask the user to sign out of all Microsoft 365 applications and sign back in to trigger the registration prompt.
• Check that the user account is not excluded from MFA in conditional access policies.

Authenticator App Not Generating Codes

• Verify the mobile device has an active internet connection or cellular signal.
• Ensure the device date and time are set to Automatic. Incorrect time settings will cause verification codes to fail.
• Remove the account from Microsoft Authenticator and re-add it by scanning a new QR code from the admin centre.

Locked Out After Enabling MFA

• If a user loses their mobile device, a global administrator can sign in to the Microsoft 365 admin centre, go to Users > Active users, select the affected user, and click Require MFA again to reset their registration.
• Always maintain at least one emergency access account that is excluded from MFA policies, stored in a secure location.

Implementing MFA is one of the most effective steps your business can take to satisfy cyber insurance checklists and protect against unauthorised access. If you need assistance configuring conditional access policies or reviewing your security posture against insurer requirements, Open a Ticket and our Brisbane support team will help you get it right.

Still Having Issues?