# Password and Multi-Factor Authentication Set-up

Source: https://dijitulsupport.co.uk/password-mfa-setup/
Updated: 2026-10-10

> dijitul support sets up multi-factor authentication and better passwords for UK businesses: Microsoft Authenticator, passkeys, Windows Hello, security keys, Conditional Access and a shared password manager. We also move staff off SMS codes before Microsoft retires them for most Entra ID users on 1 February 2027. Set-up is £45 an hour + VAT.

## Common symptoms

- Some staff have MFA and some do not
- People still get sign-in codes by text message
- Staff are being asked to 'register a passkey' and do not know what it means
- Someone approved a sign-in prompt they did not start
- Passwords live in a spreadsheet or on sticky notes
- A staff member got a new phone and is locked out

## Key facts

- Microsoft made passkeys the default for users on SMS or voice MFA from 1 September 2026
- Microsoft-provided SMS and voice MFA retires for most Entra ID users on 1 February 2027
- Global Administrators and external users follow on 1 July 2027
- Microsoft Authenticator uses number matching to stop accidental approvals
- Security defaults are free; Conditional Access needs Entra ID P1, included in Business Premium
- The NCSC recommends three random words for memorable passwords
- £45 an hour + VAT, or part of the Business and Complete plans' included hours

## Why MFA matters for a small business

The UK Government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that 43% of UK businesses reported a cyber security breach or attack in the previous 12 months, with phishing the most common type by a wide margin. Phishing usually aims to steal a password. MFA means a stolen password alone is not enough to get into email, files or the accounts system.

MFA is not all equal. Text message codes can be intercepted or phished. Push approvals can be abused by 'MFA fatigue' attacks that send prompt after prompt until someone taps Approve. Passkeys and security keys are phishing-resistant, because they only work on the genuine website. For more on the threat, see phishing protection.

## Microsoft is retiring SMS and voice codes

Microsoft has announced that it is retiring its own SMS and voice delivery for MFA in Microsoft Entra ID, which covers Microsoft 365 sign-ins:

- **From 1 September 2026**, users enabled for SMS or voice are automatically enabled for passkeys and prompted to register one.
- **From 1 February 2027**, Microsoft-provided SMS and voice are retired for all users except Global Administrators and external users. Users whose only method is SMS or voice must register a passkey at sign-in, and this prompt cannot be skipped.
- **From 1 July 2027**, the same applies to Global Administrators and external users.

Businesses that still need SMS can use a third-party telephony provider through the Microsoft Security Store, but for most small businesses the better move is to get everyone onto Microsoft Authenticator or a passkey now, on your timetable, rather than through a blocking prompt on a busy morning.

## The methods we set up

- **Microsoft Authenticator** with number matching: the user types the number shown on screen into the app, which stops blind approvals.
- **Passkeys**: a phishing-resistant credential stored in Microsoft Authenticator or on a device, unlocked with a fingerprint, face or PIN.
- **Windows Hello for Business**: sign in to the laptop with face or PIN, which also counts as strong authentication for Microsoft 365.
- **FIDO2 security keys**: small USB or NFC keys, ideal for admins and staff who cannot use a personal phone for work.

On the policy side, we turn on security defaults for tenants without Entra ID P1. On Microsoft 365 Business Premium we use Conditional Access instead: MFA for everyone, phishing-resistant methods for admins, blocking legacy authentication, and requiring a compliant device through Intune. We also create two emergency 'break-glass' admin accounts, so you can never be completely locked out.

## Passwords and password managers

MFA does not make passwords irrelevant. The National Cyber Security Centre (NCSC) recommends three random words for passwords people need to remember, and a password manager for everything else. We set up a business password manager with shared vaults, so the Wi-Fi password, supplier portals and domain registrar login are stored securely, not in a spreadsheet, and access is removed cleanly when someone leaves.

We also turn on MFA for the services outside Microsoft 365 that criminals target: online banking, accounting software, your domain registrar, website admin and social media accounts. Self-service password reset means staff can reset a forgotten password themselves after proving who they are.

## Rolling it out and cost

We start with a check of who has which methods registered, then roll out in small groups with a short how-to for staff. Phone changes are the most common cause of lockouts, so we show people how to move Authenticator to a new phone before they trade the old one in.

MFA and password manager set-up is £45 an hour + VAT, with a 30-minute minimum and then 15-minute blocks. For most small teams it takes a few hours. On the Business plan (£50 a month + VAT) or Complete plan (£99 a month + VAT) it comes out of your included hours. See support plans.

## FAQs

### Is Microsoft stopping SMS codes for MFA?

Yes, for Microsoft Entra ID. Microsoft-provided SMS and voice MFA retires for most users on 1 February 2027, and for Global Administrators and external users on 1 July 2027. Users relying only on SMS must register a passkey. dijitul can move your team over in advance.

### What is a passkey?

A passkey is a sign-in credential stored on your phone, laptop or a security key and unlocked with your fingerprint, face or PIN. It only works on the genuine website, so it cannot be phished like a password or text code. dijitul can set up passkeys for Microsoft 365.

### Do we need Business Premium for MFA?

No. Security defaults, which require MFA for all users, are free in every Microsoft 365 tenant. Business Premium adds Conditional Access, which lets you set finer rules, such as requiring a managed device or blocking risky sign-ins. dijitul advises which suits your business.

### What is MFA fatigue?

MFA fatigue is when an attacker with a stolen password sends repeated sign-in prompts until the user approves one to make them stop. Number matching in Microsoft Authenticator and phishing-resistant passkeys prevent it. dijitul configures both.

### What happens if someone loses their phone with Authenticator on it?

An administrator can remove their MFA methods and issue a Temporary Access Pass so they can register a new phone. dijitul can do this remotely once we have confirmed the person's identity, and we recommend a second method, such as Windows Hello, as a backup.

### How much does MFA set-up cost?

MFA and password manager set-up is £45 an hour + VAT, with a 30-minute minimum. Most small teams take a few hours. On the Business or Complete plans, the work comes out of your included monthly hours.

## Pricing and contact

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Plans: Essential £25/month + VAT (Website software updates (core, plugins, themes) applied and checked, Daily backups, Uptime monitoring, Security monitoring); Business £50/month + VAT (Everything in Essential, 1 hour of fixes or changes every month, Priority support); Complete £99/month + VAT (Everything in Business, 3 hours of fixes or changes every month, IT and Microsoft 365 helpdesk for your team). Ad-hoc support is £45 an hour + VAT. The first 30 minutes are the minimum charge, then we bill in 15-minute blocks. Contact: 01623 650333, support@dijitul.uk, https://dijitulsupport.co.uk/contact/