A password is not the whole defence
MFA adds a verification requirement beyond the password. It reduces dependence on a single secret but does not remove every account risk. Choose methods supported by your subscription and organisation policy, and prefer stronger, phishing-resistant options where available.
Plan enrolment and recovery
Before enforcing MFA, identify administrators, users and applications that may be affected. Prepare recovery arrangements and a process for lost phones. Test a small authorised group first. Employees should enrol through official sign-in pages and never send verification codes to support staff.
Respond to unexpected prompts
Reject verification requests you did not initiate and notify your IT contact. Repeated prompts may indicate an account attack or a configuration problem. Investigate the account and sign-in activity instead of accepting just to stop the notifications.
Sources and further reading
Options vary by product version, subscription and organisation policy. Refer to the vendor documentation before making changes.
Need help putting this into practice?
Describe your current setup and the issue. We will clarify the appropriate next step and scope of support.
Related service ↗