11/04/2026
When I ask business owners whether they use multi-factor authentication, the answer is almost always yes.
When I look at the environment, the real answer is usually "mostly."
MFA is one of the most effective controls in Microsoft 365. It's also one of the easiest to implement unevenly. As a CTO, I learned that security controls fail at the edges: the exceptions, the workarounds, the accounts nobody thinks about. MFA is no different.
The gaps I see most often:
• Admin accounts. The most powerful accounts are sometimes the least protected, because they were set up early, by a vendor, or "temporarily."
• Shared mailboxes and service accounts. Info@, billing@, the scanner account. Nobody owns them, so nobody secures them.
• The exception. The executive who found it inconvenient, or the employee who couldn't get the app working and was told to skip it for now.
• Weak methods. Text-message codes are better than nothing, but administrators should use app-based approval or phishing-resistant methods.
An attacker doesn't need to compromise every account. They need one. And it only takes one unprotected login with the right permissions to reach everything else.
A quick check you can do this week:
1. Is MFA required for everyone, or just available?
2. Do your admin accounts use stronger methods than text messages?
3. Can you produce a list of who hasn't enrolled?
If any answer is "I'm not sure," you're in good company. It's the most common answer I hear, and it's a straightforward thing to fix.
See what's included in a Microsoft 365 Security Review: https://www.teamlogicit.com/dentontx/ms365
Where have you found MFA hardest to roll out: admin accounts, shared mailboxes, or getting everyone enrolled?
