MFA for small business: which kind to use and why

Multi-factor authentication (MFA) means signing in with more than just a password. The Essential Eight, ASD's baseline for Australian organisations, sets the minimum at Maturity Level One as something users have combined with something users know: for example, your phone plus your password.

MFA stops a huge range of attacks. The catch is that some kinds of MFA can still be tricked. Criminals now run fake sign-in pages that collect your password and your one-time code at the same moment, then use both straight away. Microsoft describes SMS, email codes and authenticator apps as prone to this kind of remote phishing. The answer is phishing-resistant MFA.

The common types, from weakest to strongest

SMS and voice call codes

A code is texted or read out to your phone. It is better than a password alone, but ASD calls SMS and voice "weaker multi-factor authentication implementations" because telecommunications networks do not provide end-to-end security. A code can also be typed into a fake page.

Microsoft is moving away from it. Microsoft Learn states that SMS and voice are no longer positioned as secure methods and that Microsoft-provided SMS and voice authentication in Entra ID is being retired:

• From 1 September 2026: users enabled for SMS or voice are automatically enabled for passkeys and prompted to register one when they sign in with MFA.
• From 1 February 2027: Microsoft-provided SMS and voice is retired for all users except Global Administrators and external users. Users whose only MFA method is SMS or voice must register a passkey to keep signing in.
• From 1 July 2027: it is retired for Global Administrators and external users too.

If anyone in your Microsoft 365 tenant still relies on text message codes, now is the time to move them.

Authenticator app codes and push approvals

The Microsoft Authenticator app can show a six-digit code or send a push notification asking you to approve a sign-in. A known weakness of push approvals was "MFA fatigue", where an attacker with your password sends prompt after prompt until someone taps Approve. Microsoft now uses number matching for all Authenticator push notifications: the sign-in screen shows a number and you must type that number into the app. Users cannot opt out. This is a real improvement, but Microsoft still does not list app codes or push approvals as phishing-resistant, because a user can still be tricked into approving a sign-in started from a fake page.

Passkeys

A passkey is a FIDO2 credential made of two keys. The private key stays on your device and the public key is stored with the website or app. Microsoft Learn explains that a passkey only works on the website or app it was created for. A fake sign-in page on a look-alike domain gets nothing it can use, which is what makes passkeys phishing-resistant. You unlock the passkey with your phone's PIN, fingerprint or face.

There are two kinds:

• Device-bound passkeys stay on one device, such as a passkey in Microsoft Authenticator or a FIDO2 security key.
• Synced passkeys are stored in a provider such as Apple iCloud Keychain or Google Password Manager and work across your devices.

Microsoft calls passkeys the default phishing-resistant credential for Entra ID.

Security keys and Windows Hello for Business

A FIDO2 security key is a small USB or NFC device. Microsoft recommends security keys or Authenticator passkeys for highly regulated industries and users with elevated privileges, such as administrators. Windows Hello for Business lets staff sign in to their PC with a PIN or face recognition tied to a key stored in the computer's security chip. ASD notes that biometrics alone do not count as MFA, but they are acceptable when they unlock a key held in a Trusted Platform Module, which is how Windows Hello for Business works.

What ASD recommends

ASD's guidance says phishing-resistant MFA should be implemented for all online services, and that MFA is most effective when one of the factors uses public key cryptography. Under the Essential Eight, phishing-resistant MFA is optional at Maturity Level One. At Maturity Level Two it becomes required for users of online services and for signing in to workstations. If you are working towards Level Two, plan for passkeys, security keys or Windows Hello for Business now.

A practical plan for a Microsoft 365 business

1. Find who still uses SMS or voice. Microsoft provides a PowerShell script to identify affected users.
2. Register passkeys in Microsoft Authenticator for everyone with a work or company-managed phone.
3. Give administrators FIDO2 security keys, with a spare stored securely.
4. Turn on Windows Hello for Business on company PCs.
5. Use Conditional Access authentication strengths to require phishing-resistant methods for admin roles first, then everyone else.
6. Plan for lost phones and keys. Decide how a staff member proves who they are when their device is gone, and write it down.
7. Remove SMS and voice from the allowed methods once everyone has moved.

Which MFA methods your staff actually use is one of the things we check in a free risk check with Shane.

Summary

• SMS and voice codes: weakest, and Microsoft-provided SMS and voice is being retired from 1 February 2027.
• Authenticator codes and push with number matching: good, but still phishable.
• Passkeys, FIDO2 security keys and Windows Hello for Business: phishing-resistant, and recommended by both ASD and Microsoft.
• Start with admins, then move everyone, then switch off SMS.