MFA..... get somebody else to mark your homework.

Multi-Factor Authentication (MFA) needs to be implemented properly, and then checked by somebody independent. As I have warned before..... marking your own homework is a risky habit when access to your business is at stake!

A recent Japanese survey by security firm Act reinforces the point. Among respondents reporting account compromise or suspected incidents, 43% said MFA had been temporarily disabled or excluded for the affected account.

Another 21.4% reported problems with the authentication method or its settings. These are self-reported findings, including suspected incidents, but they are a useful reminder of how protection can fall through the gaps.

BUT..... saying “MFA is switched on” does not establish which accounts, applications and access routes it actually protects. That temporary exception created during a migration may still be there.....

Get professional help with the implementation. If your own team has already done it, get somebody independent of that work to check the result. Even very good IT teams benefit from a fresh pair of eyes.

A proper review should examine coverage, exclusions, administrator accounts, authentication methods, enrolment and recovery processes. It should also test whether the controls work as intended, rather than simply confirming that the settings look right. Microsoft’s own incident-response guidance describes how attackers exploit exclusions and gaps in access policies.

And this applies beyond Microsoft..... other cloud services, remote access and business applications deserve the same attention, regardless of whose MFA solution you use.

Ask for written findings, prioritised fixes and verification afterwards. Schedule further reviews as systems change, and keep users trained to recognise suspicious sign-in requests and unexpected MFA prompts.