Multi-Factor Authentication (MFA) requires users to prove identity with two or more factors — something they know (password), something they have (phone or security key), or something they are (biometric). Passwords alone are the top entry point for ransomware and business email compromise. Enabling MFA on Microsoft 365, VPN, and admin consoles blocks most credential-stuffing attacks even when passwords leak. Roll out MFA with a phased plan: protect global admins first, then all staff. Prefer authenticator apps or passkeys over SMS where possible, and document recovery procedures so lockouts do not halt operations.
