Should your business make MFA mandatory?

The short answer is yes. The longer answer is about how: which accounts the rule covers, which exceptions you allow, and what happens when someone loses their phone. If you need a refresher on what multi-factor authentication (MFA) is, start with our lesson Multi-factor authentication: what it is and where to start.

Why optional is not enough

An optional rule protects the people who chose to turn it on. An attacker working through a list of stolen passwords only needs one person who did not. Microsoft’s guidance makes the point that administrators are not the only targets: attackers frequently go after ordinary users, and once inside one account they can ask colleagues for information or copy the staff directory to phish everyone else.

The numbers support a blanket rule. Microsoft’s research found that MFA can block more than 99.2% of account compromise attacks. The Australian Signals Directorate (ASD) reports that 42% of the more serious incidents reported to it in 2024-25 involved compromised accounts or credentials.

Your suppliers have already decided for you

For administrator accounts, this is no longer your choice to make.

• Microsoft began requiring MFA for every sign-in to the Azure portal, the Entra admin centre and the Intune admin centre in October 2024, and to the Microsoft 365 admin centre from February 2025. Its documentation says there is no way to opt out.
• Microsoft 365 security defaults, which are switched on for new organisations, require all users to register for MFA and block the older sign-in methods that cannot use it.
• Google is rolling out enforced 2-Step Verification for all Google Workspace administrator accounts. Administrators who do not enrol lose access to mobile apps after 15 days and to web apps after 30.

The Essential Eight points the same way. At Maturity Level One, the first level, it expects MFA whenever staff sign in to an online service that holds the organisation’s sensitive data, whether the organisation runs that service or a third party does. So the decision that remains is about everyone who is not an administrator, and every service that is not Microsoft or Google.

What mandatory should mean

• Everyone is covered. That includes owners and directors, part-time staff and contractors. Guest accounts count too: Microsoft’s security defaults treat them the same as your own users.
• The system enforces it. A line in the staff handbook is a request. Microsoft 365 and Google Workspace both have a setting that refuses a sign-in without the second step, and that setting is the rule.
• It reaches beyond email. ASD’s list of high-risk accounts to start with is email, banking, cloud storage, accounting software and social media. Add the website, the domain name and anything else that can move money or holds customer records.
• It names the methods you accept. Google Workspace, for example, lets an administrator allow any method, any method except text messages and phone calls, or security keys only.
• Old sign-in methods are switched off. Microsoft notes that older mail protocols such as IMAP and POP3 do not support MFA, so an attacker can use them to go around it. A mandatory rule that leaves them on has a hole in it.

The exceptions people will ask for

“I do not have a work phone.” An authenticator app only shows codes. It does not give the business a view of anything else on the phone. For anyone who would still rather keep work off a personal phone, ASD lists two options that need no phone at all: a physical token that displays a code, and a security key that plugs into the computer.

“The scanner cannot do MFA.” Scan-to-email devices and old mail programs often use the older sign-in methods described above. They need to be set up a different way, which Microsoft documents. Leaving the old method on for the whole organisation to keep one scanner working is a poor trade.

“What if I lose my phone?” This is the fair objection, and the answer is a second method. The US National Institute of Standards and Technology (NIST) says people should be encouraged to keep at least two separate ways to authenticate. Google Workspace offers backup codes for the same reason. Decide in advance who can reset someone’s MFA and how that person confirms they are talking to the real employee.

“What if the administrator is locked out?” Microsoft recommends keeping two emergency administrator accounts that belong to no individual, for this case. They must use MFA as well. Microsoft suggests a passkey for them.

Bringing it in without a bad Monday

Google’s deployment guide for administrators sets out an order that works on any platform.

1. Tell staff what is changing, why, which methods they can use, and the date it becomes compulsory.
2. Let people enrol before the date, with written instructions. Ask each person to set up two methods.
3. Track enrolment. Google Workspace has a report of who has enrolled, and Microsoft publishes a way to check the same thing. Chase the people who have not, starting with anyone who handles money.
4. Before enforcing, check that nobody still depends on a method you are about to disallow. Google warns that users who rely on text messages are locked out if that method is switched off underneath them.
5. Enforce on the date you announced.
6. Enrol new starters on their first day. Google allows a grace period for new accounts; keep it short. Microsoft removed its 14-day grace period from security defaults in 2024, because accounts were at risk during the gap.

What a mandatory rule does not do

MFA narrows the problem without ending it. The US Cybersecurity and Infrastructure Security Agency (CISA) describes fake sign-in pages that collect the six-digit code along with the password, and attackers who send approval prompts again and again until someone taps yes. This is why the Essential Eight asks for phishing-resistant MFA from Maturity Level Two. Staff still need to know never to approve a prompt they did not start.

To see where the business sits against the Essential Eight, MFA included, our free Essential Eight assessment takes about five minutes. If you would like the rule set up and enforced for you, with conditional access and with accounts removed when staff leave, that is the work of Identity & Access Management.