MFA

MFA stops most stolen passwords. The right kind stops phishing too.

Multi-factor authentication means a password alone is not enough to get in. But not all MFA is equal: text codes and app approvals can be phished, passkeys cannot. Here is how the methods compare, what the Essential Eight asks for, what changes in Microsoft 365 in 2027, and the order to roll it out.

Essential Eight requirements from ASD. Microsoft dates from Microsoft Learn, checked 30 October 2026.

Plan your MFA rollout Check your methods 07 3114 2808

Methods ranked
Essential Eight levels
Method check for your team

Reviewed by Blake Bath, General Manager, on 30 October 2026.

An architect holds up her phone to approve a sign-in, with her laptop on a stand and a timber house model on the desk in front of her. — **1 February 2027**Microsoft stops sending its own MFA texts and calls in Microsoft 365.

The methods

Four kinds of second factor, weakest to strongest.

All are better than a password alone. Only the last one cannot be phished.

Text or phone call

A code by SMS or a voice call. Can be intercepted through SIM swaps, and phished.

Retiring in Microsoft 365
Essential Eight Level One
Move away now

MFA method check

How strong is the MFA your team uses today?

Pick the method each group uses now. The result shows where you sit against the Essential Eight and what to fix first.

Pick the second factor each group uses today. The result shows where you sit against the Essential Eight and what to change first.

Admins

Finance and payroll

Everyone else

Where you sit

ML1Meets Level One MFA

Microsoft stops sending its own MFA texts and calls on 1 February 2027 (1 July 2027 for Global Admins). Move these people to an app or a passkey now.
Admins first: move them to passkeys or security keys. A phished admin account can undo every other control.
Finance next. App codes and push can be phished through fake sign-in pages that pass the code straight on.

MFA method only. The Essential Eight also asks where MFA applies, and for logging at Level Two.

Plan the move to passkeys

What ASD asks for

MFA in the Essential Eight.

Where	Level One	Level Two	Level Three
Online services with sensitive data, such as Microsoft 365	Any MFA	Phishing-resistant	Phishing-resistant
Systems, for privileged and unprivileged users	Not required	Phishing-resistant	Phishing-resistant
Online customer services	Any MFA	Phishing-resistant as an option	Phishing-resistant
Data repositories	Not required	Not required	Phishing-resistant
Logging MFA events centrally	Not required	Required	Required

Summary of ASD's guidance. Check the full Essential Eight maturity model for the exact wording before an assessment.

How MFA gets beaten

Six ways attackers get around MFA.

Fake sign-in pages that relay codesA page that looks like Microsoft passes your password and code to the real site and keeps the session. Fix: passkeys or security keys.
Approval spamPrompt after prompt until someone taps yes. Fix: number matching, now on by default in Microsoft Authenticator.
SIM swapYour number moved to the attacker's SIM to receive your codes. Fix: stop using SMS.
Session theftMalware or a fake page steals the sign-in token after MFA. Fix: managed devices, Conditional Access and token protection where supported.
Help desk tricksA caller pretends to be staff and asks for an MFA reset. Fix: a verification process the help desk always follows.
DowngradePushing someone back to a weaker method. Fix: block legacy sign-in and require strong methods for admins.

Our approach

Admins on passkeys first, then everyone else.

We move admins to passkeys or security keys first, because a phished admin account can switch off everything else. Finance and payroll make sense next, because attackers target them for payment fraud, then everyone else.

Before switching anything on, make sure people have registered their new method and that there is a tested way back in for someone who loses their phone.

Rollout

An MFA rollout in six steps.

Step 1Microsoft 365 first
Enforce MFA with Conditional Access, or Security Defaults without P1.
Step 2Every other login
Accounting, CRM, password manager, banking, remote access.
Step 3Admins to passkeys
Security keys or passkeys for every admin account.
Step 4Emergency access
Two cloud-only accounts on security keys, tested.
Step 5Everyone to passkeys
Finance next, then all staff, before February 2027.
Step 6Show staff
Never approve a prompt you did not start. Report it.

Related guides

MFA is the start. Passkeys are where it is heading.

Go deeper on each part of strong sign-in.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about MFA.

What is the best MFA for a business?

Phishing-resistant MFA: passkeys, Windows Hello for Business or a FIDO2 security key. These only work on the real website, so a fake sign-in page cannot capture them. Authenticator app push with number matching is a reasonable step up from text messages while you move.

Is SMS MFA still OK?

It is better than nothing, but it can be intercepted through SIM swaps and fake sign-in pages. In Microsoft 365, Microsoft stops sending its own MFA texts and calls on 1 February 2027, and on 1 July 2027 for Global Admins and external users.

What does the Essential Eight say about MFA?

At Maturity Level One, any MFA for users of online services. At Level Two, phishing-resistant MFA for users of online services that hold sensitive data, and for privileged and unprivileged users of systems, with MFA events logged centrally. Level Three extends phishing-resistant MFA to data repositories and customer services.

Does MFA stop every attack?

No. App codes and push approvals can be phished through fake sign-in pages that pass them straight to Microsoft and steal the session. Malware on a device can steal sessions too. Phishing-resistant methods, managed devices and Conditional Access close most of that gap.

Should emergency admin accounts have MFA?

Yes. Microsoft now recommends cloud-only emergency access accounts protected with a phishing-resistant method such as a FIDO2 security key, kept separate from everyday admins and excluded only from policies that could lock them out. Old advice to leave them without MFA is out of date.

What is number matching?

When you approve a sign-in in Microsoft Authenticator, you type the number shown on the sign-in screen. It stops someone spamming you with approval requests until you tap yes by mistake.

Next step