Sound familiar?
- Some staff have MFA and some do not
- People still get sign-in codes by text message
- Staff are being asked to 'register a passkey' and do not know what it means
- Someone approved a sign-in prompt they did not start
- Passwords live in a spreadsheet or on sticky notes
- A staff member got a new phone and is locked out
Key facts
- Microsoft made passkeys the default for users on SMS or voice MFA from 1 September 2026
- Microsoft-provided SMS and voice MFA retires for most Entra ID users on 1 February 2027
- Global Administrators and external users follow on 1 July 2027
- Microsoft Authenticator uses number matching to stop accidental approvals
- Security defaults are free; Conditional Access needs Entra ID P1, included in Business Premium
- The NCSC recommends three random words for memorable passwords
- £45 an hour + VAT, or part of the Business and Complete plans' included hours
Why MFA matters for a small business
The UK Government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that 43% of UK businesses reported a cyber security breach or attack in the previous 12 months, with phishing the most common type by a wide margin. Phishing usually aims to steal a password. MFA means a stolen password alone is not enough to get into email, files or the accounts system.
MFA is not all equal. Text message codes can be intercepted or phished. Push approvals can be abused by 'MFA fatigue' attacks that send prompt after prompt until someone taps Approve. Passkeys and security keys are phishing-resistant, because they only work on the genuine website. For more on the threat, see phishing protection.
Microsoft is retiring SMS and voice codes
Microsoft has announced that it is retiring its own SMS and voice delivery for MFA in Microsoft Entra ID, which covers Microsoft 365 sign-ins:
- From 1 September 2026, users enabled for SMS or voice are automatically enabled for passkeys and prompted to register one.
- From 1 February 2027, Microsoft-provided SMS and voice are retired for all users except Global Administrators and external users. Users whose only method is SMS or voice must register a passkey at sign-in, and this prompt cannot be skipped.
- From 1 July 2027, the same applies to Global Administrators and external users.
Businesses that still need SMS can use a third-party telephony provider through the Microsoft Security Store, but for most small businesses the better move is to get everyone onto Microsoft Authenticator or a passkey now, on your timetable, rather than through a blocking prompt on a busy morning.
The methods we set up
- Microsoft Authenticator with number matching: the user types the number shown on screen into the app, which stops blind approvals.
- Passkeys: a phishing-resistant credential stored in Microsoft Authenticator or on a device, unlocked with a fingerprint, face or PIN.
- Windows Hello for Business: sign in to the laptop with face or PIN, which also counts as strong authentication for Microsoft 365.
- FIDO2 security keys: small USB or NFC keys, ideal for admins and staff who cannot use a personal phone for work.
On the policy side, we turn on security defaults for tenants without Entra ID P1. On Microsoft 365 Business Premium we use Conditional Access instead: MFA for everyone, phishing-resistant methods for admins, blocking legacy authentication, and requiring a compliant device through Intune. We also create two emergency 'break-glass' admin accounts, so you can never be completely locked out.
Passwords and password managers
MFA does not make passwords irrelevant. The National Cyber Security Centre (NCSC) recommends three random words for passwords people need to remember, and a password manager for everything else. We set up a business password manager with shared vaults, so the Wi-Fi password, supplier portals and domain registrar login are stored securely, not in a spreadsheet, and access is removed cleanly when someone leaves.
We also turn on MFA for the services outside Microsoft 365 that criminals target: online banking, accounting software, your domain registrar, website admin and social media accounts. Self-service password reset means staff can reset a forgotten password themselves after proving who they are.
Rolling it out and cost
We start with a check of who has which methods registered, then roll out in small groups with a short how-to for staff. Phone changes are the most common cause of lockouts, so we show people how to move Authenticator to a new phone before they trade the old one in.
MFA and password manager set-up is £45 an hour + VAT, with a 30-minute minimum and then 15-minute blocks. For most small teams it takes a few hours. On the Business plan (£50 a month + VAT) or Complete plan (£99 a month + VAT) it comes out of your included hours. See support plans.
What it costs
Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.
Essential
Keep it updated, backed up and watched.
- Website software updates (core, plugins, themes) applied and checked
- Daily backups
- Uptime monitoring
- Security monitoring
Business
Updates plus an hour of fixes every month.
- Everything in Essential
- 1 hour of fixes or changes every month
- Priority support
Complete
Website and your team's IT, covered.
- Everything in Business
- 3 hours of fixes or changes every month
- IT and Microsoft 365 helpdesk for your team
No plan? The first 30 minutes are the minimum charge, then we bill in 15-minute blocks.
Frequently asked questions
Is Microsoft stopping SMS codes for MFA?
Yes, for Microsoft Entra ID. Microsoft-provided SMS and voice MFA retires for most users on 1 February 2027, and for Global Administrators and external users on 1 July 2027. Users relying only on SMS must register a passkey. dijitul can move your team over in advance.
What is a passkey?
A passkey is a sign-in credential stored on your phone, laptop or a security key and unlocked with your fingerprint, face or PIN. It only works on the genuine website, so it cannot be phished like a password or text code. dijitul can set up passkeys for Microsoft 365.
Do we need Business Premium for MFA?
No. Security defaults, which require MFA for all users, are free in every Microsoft 365 tenant. Business Premium adds Conditional Access, which lets you set finer rules, such as requiring a managed device or blocking risky sign-ins. dijitul advises which suits your business.
What is MFA fatigue?
MFA fatigue is when an attacker with a stolen password sends repeated sign-in prompts until the user approves one to make them stop. Number matching in Microsoft Authenticator and phishing-resistant passkeys prevent it. dijitul configures both.
What happens if someone loses their phone with Authenticator on it?
An administrator can remove their MFA methods and issue a Temporary Access Pass so they can register a new phone. dijitul can do this remotely once we have confirmed the person's identity, and we recommend a second method, such as Windows Hello, as a backup.
How much does MFA set-up cost?
MFA and password manager set-up is £45 an hour + VAT, with a 30-minute minimum. Most small teams take a few hours. On the Business or Complete plans, the work comes out of your included monthly hours.
Related
Get it fixed
One-off fixes are £45 an hour + VAT. You'll know the likely cost before we start.