Use all three, in that order of strength. Keep passwords long and unique (three random words, stored in a password manager), switch on multi-factor authentication for every user on every cloud service, and move to passkeys where they're supported. The NCSC now recommends passkeys as the preferred way to sign in. Since April 2026, Cyber Essentials automatically fails any business that leaves MFA switched off where it's available.
Why do logins matter so much?
Most attacks on small businesses don't break in; they log in. Microsoft reports that more than 97% of identity attacks are password attacks, and that MFA blocks over 99% of identity-based attacks (Microsoft Digital Defense Report, 2025). Yet only 47% of UK businesses and 38% of charities use two-factor authentication (DSIT, 2026).
That gap is why the three reasons for MFA still stand. It's usually free, built into Microsoft 365, Google Workspace, Xero, Sage and most other cloud platforms. It's easy, often one tap or a fingerprint. And it works: a stolen password alone is no longer enough. What's changed since 2023 is that attackers now target weaker forms of MFA too, and passkeys have become a realistic alternative.
What makes a good password in 2026?
Passwords aren't going away yet, so they still need to be good. The NCSC's advice is to combine three random words, such as "applenemobiro", which gives a password that's long enough to resist guessing but easy to remember. Swapping letters for numbers ("p4ssw0rd") adds little. Names, birthdays, football teams and the company name are the first things attackers try.
Every account needs a different password. Reuse is the real danger: when one website is breached, criminals try the same email and password on Microsoft 365 within hours. A password manager solves this by generating and storing a unique password for every account, so staff only remember one strong master password. Business password managers also let you share team logins safely instead of pinning them in a spreadsheet.
Don't force regular password changes. The NCSC advises against it, because people respond with predictable patterns (Summer2026!, Autumn2026!). Change a password when there's a reason: a breach, a suspicious sign-in or a leaver. For Cyber Essentials, passwords must be at least 12 characters, or at least 8 when combined with MFA or an automatic block on common passwords.
Which type of MFA should you use?
Not all MFA is equal. Here's how the common methods compare.
| Method | How it works | Protection against phishing | Main weakness | Best use |
|---|---|---|---|---|
| SMS or voice code | A code sent by text or call | Low | SIM-swap fraud; codes can be typed into a fake login page | Fallback only, where nothing else works |
| Authenticator app code (TOTP) | A six-digit code that changes every 30 seconds | Medium | Can still be typed into a fake page | Services that don't support push or passkeys |
| Push notification with number matching | Approve a prompt and type the number shown on screen, e.g. Microsoft Authenticator | Medium to high | Fake login pages that pass a sign-in on in real time can still get through | The default for most Microsoft 365 users |
| Passkey (device or phone) | Face, fingerprint or PIN unlocks a key held on your device | High | Needs a supported device; recovery must be planned | The target for everyone, starting with admins and finance |
| FIDO2 security key | A physical USB or NFC key | High | Cost (roughly £30–£70 a key including VAT for standard Yubico models) and keys can be lost | Admin accounts, shared or high-risk roles |
Microsoft switched on number matching by default for Authenticator after "MFA fatigue" attacks, where criminals send prompt after prompt until someone taps approve. If you're still using plain approve/deny prompts or SMS codes, moving to number matching is a quick win.
Are passkeys ready for business use?
Largely, yes. In April 2026 the NCSC said passkeys should now be the preferred way to log in, after its technical analysis found them at least as secure as, and generally more secure than, a strong password plus two-step verification. A passkey can't be phished, reused or guessed, because it only works on the genuine website and never leaves your device. Google reports that more than half of its active UK users already have one registered.
For a Microsoft 365 business, passkeys can live in Microsoft Authenticator on a phone, in Windows Hello for Business on a laptop, or on a FIDO2 security key (a small physical key). Start with the accounts that matter most: global admins, finance, payroll and directors. The catch is that not every business app supports them yet, so for now most businesses will run passkeys where they can and strong MFA everywhere else. Plan recovery too: what happens when someone loses their phone on a Friday?
How do you switch on MFA in Microsoft 365?
There are two routes, and your licence decides which.
Security defaults are free with every Microsoft 365 plan. They require every user to register for MFA with Microsoft Authenticator, always challenge administrators, and block legacy sign-in methods (old POP, IMAP and SMTP connections that can't do MFA). New Microsoft tenants (business accounts) have them on by default. They're a big improvement on nothing, but they're all or nothing: you can't make exceptions or add rules.
Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. It lets you set rules: require MFA for everyone, require phishing-resistant methods for admins, block sign-ins from outside the UK, only allow access from managed devices, and demand re-authentication for risky actions. Most businesses with more than a handful of staff, or with Cyber Essentials Plus in mind, are better served by Conditional Access.
Example: a 40-person charity on Microsoft 365 Business Standard with security defaults switched off years ago "because staff complained". Week one: list every system and check which support MFA or passkeys (Microsoft 365, the finance package, the CRM, payroll). Week two: brief staff, send a one-page guide, and register everyone for Authenticator during a team meeting. Week three: switch on security defaults, set up two emergency "break-glass" admin accounts stored securely, and turn on MFA in the other systems. Week four: fix stragglers and anything using legacy sign-in, such as an old scanner that emails documents. Later, move to Business Premium and Conditional Access, and give admins passkeys.
How Indigo does this. Indigo Unified Communications enforces MFA for every user as part of onboarding a new client, which usually takes about two weeks, and checks it across every cloud service as part of Cyber Essentials support. Our Platinum package includes Microsoft 365 Business Premium, so Conditional Access and Intune device checks are available from day one, and Gold and Platinum add dark web monitoring to warn you when a staff password appears in a breach. As a Microsoft Solutions Partner for Modern Work with 100+ Microsoft 365 migrations completed, our Glasgow team sets this up routinely. Cyber security →
What to do next
- List every system your staff log in to, and note which support MFA and passkeys.
- Switch on MFA for Microsoft 365 (security defaults or Conditional Access) and every other system that offers it, starting with email, finance and remote access.
- Roll out a business password manager and stop password reuse.
- Give admins and finance staff passkeys or security keys first.
- Stop forced password expiry, and change passwords only when there's a reason.
Frequently asked questions
Is SMS two-factor authentication still safe enough?
It's much better than a password alone, but it's the weakest form of MFA. Codes can be intercepted through SIM-swap fraud or typed into a fake login page. Use an authenticator app with number matching, or a passkey, wherever you can, and keep SMS only as a fallback for systems that support nothing else.
What is a passkey?
A passkey is a sign-in method that replaces the password with a cryptographic key stored on your phone, laptop or security key, unlocked with your face, fingerprint or PIN. It only works on the genuine website, so it can't be phished or reused. The NCSC has recommended passkeys as the preferred way to log in since April 2026.
Does Cyber Essentials require MFA?
Yes. Under version 3.3 of the requirements, used for assessments from 27 April 2026, MFA must be switched on for every cloud service where it's available, and leaving it off is an automatic failure. Passwordless methods such as passkeys are also recognised. The requirement covers all users, not just administrators.
What are Microsoft 365 security defaults?
Security defaults are a free set of Microsoft settings that require every user to register for MFA using Microsoft Authenticator, always challenge administrators, and block legacy sign-in protocols that can't use MFA. They suit small businesses without Microsoft Entra ID P1 licences. Businesses on Microsoft 365 Business Premium should use Conditional Access instead, which allows finer rules.
How often should we change our passwords?
Only when there's a reason, such as a breach, a suspicious sign-in or someone leaving. The NCSC advises against forced regular changes because they push people towards predictable patterns. A long, unique password stored in a password manager, protected by MFA, is far stronger than one changed every 90 days.
Sources: Microsoft, Microsoft Digital Defense Report 2025, 16 October 2025 (https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/) · DSIT, Cyber Security Breaches Survey 2025/2026, 30 April 2026 (https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) · NCSC, Leave passwords in the past: passkeys are the future, 23 April 2026 (https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future) · NCSC, Passkeys: what you need to know (https://www.ncsc.gov.uk/passkeys) · NCSC, Three random words (https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words) · NCSC, Password administration for system owners · Microsoft Learn, Security defaults in Microsoft Entra ID, accessed September 2026 (https://learn.microsoft.com/entra/fundamentals/security-defaults) · Microsoft Learn, Protect your Microsoft 365 user accounts (https://learn.microsoft.com/microsoft-365/enterprise/microsoft-365-secure-sign-in) · IASME, Changes to Cyber Essentials for April 2026 (https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/) · Yubico, UK online store (Security Key and YubiKey 5 series prices), accessed 28 September 2026 (https://www.yubico.com/gb/store/).
Related: Cyber security · Cyber Essentials explained · Phishing · IT support packages · Charity guide: Microsoft 365 for charities
How secure is your business, really?
Book a free security review. We'll check your Microsoft 365, devices and backups against Cyber Essentials and give you a short list of fixes.