MFA for Microsoft 365: What West Texas Offices Should Turn On
If your office in Lubbock, Amarillo, Abilene, Midland-Odessa or a South Plains town like Levelland, Brownfield or Lamesa runs on Microsoft 365, multifactor authentication (MFA) is one of the highest-value settings you can turn on. It asks for a second proof of identity after the password, so a stolen or guessed password is not enough to open email, OneDrive or Teams.
CISA tells small and medium businesses to require multifactor authentication wherever possible, start with admin accounts, and prefer stronger methods over text-message codes when they can. Microsoft's guidance for Microsoft 365 is to turn on MFA with Security defaults or Conditional Access. Here's what West Texas offices should actually turn on.
Why MFA matters for Microsoft 365
Microsoft 365 holds email, files, calendars and chat. If an attacker signs in as you, they can read mail, reset passwords, send wire-fraud messages that look real, and download shared folders. Passwords alone fail often: people reuse them, phishing sites collect them, and older email protocols can sign in without a modern MFA prompt.
MFA is not perfect. CISA and the FBI have warned that default MFA settings can be misused if inactive accounts can re-enroll a new device or if MFA "fails open" when its server is unreachable (joint advisory AA22-074A). Still: enforce MFA, review the defaults, and disable accounts that should no longer sign in.
Security defaults or Conditional Access
Microsoft's setup guide lists three options and recommends the first two for most organizations (Set up multifactor authentication for users):
Security defaults (Microsoft Entra ID Free on all Microsoft 365 tenants)
Conditional Access policies (Microsoft Entra ID P1 or P2, included with plans such as Microsoft 365 Business Premium)
Legacy per-user MFA (available, but not recommended as the primary approach)
Use Security defaults or Conditional Access, not both. Tenants created after October 2019 often already have Security defaults on, which is a solid baseline for many small offices. Business Premium (or another plan with Entra ID P1/P2) unlocks Conditional Access when you need finer control.
What Security defaults do
According to Microsoft's MFA overview for Microsoft 365, Security defaults:
Require users and admins to register for MFA with an authenticator app (Microsoft Authenticator or another app that supports OATH one-time codes)
Require MFA for administrator accounts at every sign-in
Require MFA for users when needed (for example, on a new device)
Block legacy authentication protocols such as older POP3 and IMAP4 clients
Require MFA when users or admins access Azure management tools
For many West Texas small businesses, confirming Security defaults are on is the fastest path to MFA coverage.
When Conditional Access helps
Conditional Access recreates the Security defaults baseline, then lets you tighten it. Microsoft's templates cover MFA for all users, MFA for administrators (including a phishing-resistant admin option), blocking legacy authentication, and MFA for Azure management.
That fits Business Premium offices, or any team that needs documented exceptions such as a break-glass emergency admin. If you turn Security defaults off to move to Conditional Access, recreate those baseline policies before adding custom rules. A gap with neither defaults nor Conditional Access leaves accounts unprotected.
What to turn on first
1. Confirm MFA is enforced, not optional
"Available" is not the same as "required." Security defaults build MFA registration in. With Conditional Access, set the policy to On after testing, not Report-only. Export enrollment coverage for cyber insurance questionnaires.
2. Cover every admin account
Global Admins, Exchange Admins and anyone who can change users or mail flow should use MFA on every sign-in. Keep Global Administrator use rare. CISA also says to start with admin accounts and remote access.
3. Prefer authenticator apps over text codes
CISA ranks methods from strongest to weakest: security keys, authenticator apps with number matching, authenticator apps with one-time codes, biometrics (usually with another method), then text or email codes. Text codes should be a last resort.
For most staff, Microsoft Authenticator with number matching works well. For Global Admins, plan for phishing-resistant methods such as FIDO2 security keys when you can.
4. Block legacy sign-in methods that skip MFA
Old email clients can authenticate without a modern MFA prompt. Security defaults block many legacy protocols; Conditional Access should include a block-legacy policy. Offices still running older mail apps on a Permian warehouse PC or a South Plains gin office often find this gap during an audit.
5. Clean up dormant accounts
AA22-074A describes attackers enrolling a new MFA device on an account inactive in MFA but still enabled in the directory. Disable users who left. Align MFA enrollment with Entra ID so unused mailboxes cannot become a quiet way back in.
6. Document two emergency access accounts
Microsoft says only break-glass emergency access accounts should be excluded from MFA, and recommends at least two that are not tied to one person's daily login. Write down where those credentials live. Do not exclude regular admin accounts "for convenience."
Insurance, compliance and plan choice
Cyber insurance renewals and client questionnaires almost always ask whether MFA is enforced on email, remote access and admin accounts. Our cyber insurance renewal checklist covers the broader evidence carriers want. MFA in Microsoft 365 is usually first on that list.
Business Premium includes Entra ID P1 and unlocks Conditional Access. Our post on Business Premium vs Business Standard explains that difference in plain English.
A simple rollout plan
Week 1: Confirm Security defaults are on (or Conditional Access is already in place). Tell staff before you flip the switch.
Week 1–2: Register every user on an authenticator app, including shared front-desk PCs and field laptops in Midland-Odessa or rural shops.
Week 2: Verify every admin requires MFA. Remove unused admin roles.
Week 3: Replace or reconfigure legacy mail clients for modern authentication.
Week 4: Export MFA coverage, disable dormant accounts, and file the evidence.
If your team is stretched, this is normal managed IT work. Double Technologies handles Microsoft 365 management and managed IT services across Lubbock and West Texas, including MFA rollout and proof for brokers.
Ready to lock down Microsoft 365 sign-in?
Double Technologies brings 30 years of combined experience across IT support and cybersecurity. We can work remotely and we can come to you when something needs hands on site. Our hours are Monday through Friday, 8 AM to 7 PM, and Saturday, 9 AM to 5 PM Central.
If you are not sure whether MFA is enforced on every Microsoft 365 account, call Double Technologies at (806) 319-8521. We will review Security defaults or Conditional Access with you, close the gaps that usually show up on insurance forms, and help your team enroll without chaos.
Comments