Most breaches at businesses your size start with a stolen password. Multi-factor authentication (MFA) means a password alone isn't enough to get in: the person signing in also has to approve a prompt on their phone or use a security key. It's the single most effective control you can add, and it's on every HeptaShield plan.
Why people resist it
Usually because a previous rollout asked for a code every time they opened Outlook. That's a configuration problem, not an MFA problem. Done well, most people approve a prompt a few times a week.
A rollout that works
- Tell the team why, in one paragraph, a week before.
- Use the Microsoft Authenticator app with number matching, not text messages.
- Register everyone in a short scheduled session so nobody gets locked out on a Monday morning.
- Mark company-managed devices as trusted so people aren't prompted constantly.
- Give admins separate admin accounts, with MFA required every time.
- Block legacy sign-in methods that can't use MFA.
What about shared accounts?
Shared logins are the hardest part. Replace them with individual accounts and shared mailboxes wherever possible. Where a shared account must stay, put it behind MFA tied to a manager's device and review who knows the password.
Next steps
MFA is the start. Conditional Access rules, which block sign-ins from unexpected countries or unmanaged devices, are the next layer, and they're included from the Secure plan up.