Protecting your London business with simple, reliable multi-factor authentication
A stolen password shouldn’t be enough to let someone into your business. We help teams across London set up and manage multi-factor authentication in Microsoft 365, taking care of everything from start to finish so your team stays focused and safe.
Overview
What actually is multi-factor authentication?
Simply put, MFA asks for two different pieces of proof before letting anyone into an account. For most companies, that means something you know (your password) plus something you have (your smartphone). It’s strongly recommended by the UK’s NCSC and built right into Microsoft 365 through Microsoft Entra ID.
Think of it like having two locks on your front door. Even if someone manages to copy your key, they still can’t open the door without the second lock. Day-to-day, most people barely notice it – it’s usually just a brief prompt on your phone, and mostly when you log in from a new place or device.
Here is what we set up for you:
A quick one-tap approval whenever someone signs in on a new device
Microsoft Authenticator setup with number matching to prevent accidental approvals
Automatic monitoring to spot and block unusual or suspicious sign-in attempts
Full coverage across all your Microsoft 365 apps and connected cloud services
In plain English
Multi-factor authentication (MFA) asks for a quick second check when you sign in – usually just a quick tap on your phone in the Microsoft Authenticator app. If a password ever gets compromised, an attacker still can’t log in.
At totality services, we help London businesses roll out and look after MFA across Microsoft 365 and Microsoft Entra ID, including stronger protection for key accounts.
Do you need MFA for Cyber Essentials?
Yes, you do. Cyber Essentials requires MFA on every cloud service that supports it, for all team members and admins alike. Under the current standard, having MFA available but turned off results in an automatic audit failure.
Cyber insurance providers check for this, too. If MFA isn’t actively turned on and maintained, it could jeopardize a claim if anything goes wrong. If you’re renewing insurance or working toward Cyber Essentials, having solid MFA in place is essential.
We maintain Cyber Essentials Plus and ISO 27001 certifications ourselves, and we regularly guide our clients through the process step by step.
What the standard expects
MFA on every cloud service
Wherever it is supported, for every user and every admin.
Switched on, not just available
MFA that exists but is turned off is an automatic audit failure.
Maintained over time
Insurers look for MFA that is actively kept in place, not a one-off setup.
Which MFA method works best?
Not all MFA methods offer the same level of security. While a text message code is a start, it’s fairly easy to trick. Fortunately, stronger options are already built into Microsoft 365 at no extra charge.
Text message (SMS)
A 6-digit code sent via text.
Recommended
Authenticator app prompt
A push notification asks you to verify a code on screen.
Time-based app code
A changing 6-digit code inside an app.
Passkey or security key
A physical or device key tied directly to real sign-in pages.
Can someone bypass multi-factor authentication?
While MFA makes unauthorized access vastly more difficult, clever attacks can sometimes bypass basic setups – like fake login pages that forward prompts in real time, or spamming your phone until you tap approve out of frustration.
We configure features like number matching to stop accidental approvals, and passkeys or security keys that only respond to authentic sign-in pages.
Good security is about layers. We set up Conditional Access rules to automatically challenge or block sign-ins from unfamiliar locations, unmanaged devices, or suspicious IP addresses. We also disable legacy log-in pathways so attackers can’t slip around your defenses.
Layers we put in place
Number matching so a prompt can’t be approved by accident
Passkeys or security keys that only respond to authentic sign-in pages
Conditional Access rules that challenge or block unfamiliar locations, unmanaged devices and suspicious IPs
Legacy log-in pathways disabled so attackers can’t slip around your defences
What to expect during an MFA rollout
Rolling out MFA across your business is straightforward and shouldn’t interrupt your workday. Each team member only needs about five minutes to register, and we do the heavy lifting behind the scenes.
Step 01
Review & discovery
We check all your existing user accounts, shared mailboxes, and cloud tools to see where protection is active and where gaps need closing.
Step 02
Small-scale pilot
We start with a small group first to refine settings and catch any specific setup quirks early.
Step 03
Friendly team onboarding
We onboard teams in manageable groups, sending clear instructions ahead of time and offering direct help on switchover day.
Step 04
Protection & ongoing support
Once everything is live, we turn off older, unsafe login options, activate Conditional Access, and keep an eye out for suspicious log-in activity as part of your ongoing service.
Five minutes per person
Register your work account and confirm your device.
How it feels for your team
On primary office computers, sign-in stays seamless and uninterrupted
Prompts only pop up when logging in from a new device or unfamiliar spot
Approving a request takes just a couple of seconds
Personal phones stay completely private – the app only verifies work logins and cannot access personal photos or messages
If anyone gets a log-in prompt they didn’t request, they simply deny it and let us know so we can check it out
How much does MFA cost?
Good news: MFA via the Microsoft Authenticator app is already included with standard Microsoft 365 Business subscriptions at no extra license cost. You’re only paying for our guidance in designing policies, running a smooth rollout, and managing support.
Advanced tools like Conditional Access require Microsoft Entra ID P1, which is already bundled into Microsoft 365 Business Premium plans. Many businesses already have access to this without realizing it.
What’s already in your licence
Microsoft Authenticator MFA
Microsoft 365 Business
Conditional Access (Entra ID P1)
Business Premium
Policy design, rollout & support
totality services
Supporting businesses across London
Based at St George Wharf in Vauxhall, totality services has been helping London teams with IT support since 2008. Our team of 40+ friendly specialists looks after more than 150 local companies across central, north, south, east, and west London.
We work alongside law firms, financial advisors, estate agencies, architects, charities, and professional services practices across the capital.
Since 2008
Microsoft Partner
Crown Commercial Service supplier and Feefo Platinum Trusted Service Award winner.
40+ specialists
150+ London companies
Looked after across central, north, south, east and west London.
Certified
Cyber Essentials Plus
Plus ISO 27001 and ISO 9001 certified.
“When we ask totality to do something, it gets done. It’s as simple as that.”
— Robert Hill, Greater London Properties
Common questions about MFA
Is multi-factor authentication included in Microsoft 365?
Yes! Basic MFA using the Microsoft Authenticator app comes standard with Microsoft 365 Business plans. Fancier features like Conditional Access come with Microsoft Entra ID P1, which is included in Business Premium licenses.
What if someone loses their phone?
No problem – we quickly reset authentication settings so they can register a new phone in a few minutes. We also set up secure backup methods during rollout so nobody gets locked out unexpectedly.
Are text message codes good enough for security?
Text messages are better than passwords alone, but SMS codes can be intercepted through SIM-swapping. An authenticator app is much safer, free, and just as easy to use.
Does the Authenticator app give my employer access to my phone?
No. The Microsoft Authenticator app only confirms identity for work account sign-ins. It does not give an employer access to personal apps, photos, messages or files on the device.
Do we still need MFA if we already have strong passwords?
Yes. Even strong passwords can be stolen in data breaches, phished, or logged by malware. MFA acts as your safety net so a stolen password alone isn’t enough to cause harm.
How long does setting up MFA take?
Individual setup takes about five minutes per person. The overall project timeline depends on your business size, but we roll it out in smooth, stress-free stages.