A confirmation prompt on a phone stops most attacks that use stolen passwords. With the right priorities, MFA covers every account in two weeks.
More than 10 workstations · support contract · remote, on-site and phone support
For decision-makers short on time.
Most attacks on SMEs start with a stolen password, and most of those attacks stop at a simple confirmation prompt on a phone. Multi-factor authentication (MFA) requires, on top of the password, approval in an app or with a physical key. For a business, it is the security measure with the highest return: as a rule it needs no additional licences and can be active on every account within two weeks.
Even so, we still see 100-workstation companies where only the administrator uses it. Here, DataRoad - IT Services and Consulting sets out the sequence, the methods and a 14-day timetable that leaves nobody locked out of their email.
It protects against the most frequent attack: the password was entered on a fake page, or reused on a service that suffered a data leak, and someone tries to get into email or the VPN. Without a second factor, they get in. With a second factor, they are left waiting for an approval only the victim's phone can give.
It does not protect against malware already on the computer, or against people who approve prompts automatically. Even so, it closes the most used way in.
| Method | Level of protection | For whom |
|---|---|---|
| FIDO2 physical key | Maximum; phishing-resistant | Management, finance and system administrators |
| App with notification and number matching (for example, Microsoft Authenticator) | High | The default for almost the whole team; the number prevents approving a request you did not make |
| SMS | Weak, exposed to SIM swapping and interception | Only as an emergency fallback |
| Code sent by email | Very weak | Do not use: if the email account is compromised, the second factor goes with it |
| Phase | What is done |
|---|---|
| Days 1 and 2 | All administrators on MFA. Policy finalised: mandatory, session remembered on trusted devices, SMS only as fallback. A one-page guide with screenshots. |
| Days 3 to 5 | Pilot with one department: a 15-minute session, method registration, test. Adjustments to the guide. |
| Days 6 to 10 | One department per day, with the helpdesk on standby. Anyone who has not registered is required to at their next sign-in, using Microsoft's grace period. |
| Days 11 to 14 | Remote access and equipment consoles. Legacy methods disabled. Account-by-account check in the admin panel. |
Under IT Unlimited contracts we configure the second factor on Microsoft 365, the VPN and admin consoles, as part of Microsoft 365 administration and managed cybersecurity for businesses. Conditional access ensures unmanaged devices can only get in through the browser. The monthly report shows the percentage of protected accounts; the target is always 100%.
In most cases there is no licence cost, because it is included in Microsoft 365 and Google Workspace. Physical keys cost a few tens of euros per person and make sense for higher-risk roles. The real investment is the time for implementation and training.
No, with the right policy: confirmation happens once on each trusted device, with periodic renewal. On an unknown device the prompt always appears, and that is where the protection lies.
They use a physical key, a token or a work phone. It is never a reason to be exempt.
Yes. MFA defends the account when the password is stolen; the manager stops the same password being reused on services without MFA. Find out more in business password manager.
We enable MFA on Microsoft 365, remote access and equipment consoles, with 15 minutes of training per team and nobody left locked out. Request a no-commitment proposal.
More than 10 workstations · support contract · remote, on-site and phone support. Call +351 211 459 950 * or write to sales@dataroad.pt.
*Call to a Portuguese landline.
Chosen by respected and international companies
![MUN[it]](/assets/img/logos-c/munit.webp "MUN[it]"){kind=small}
★★★★★ 5,0 · 52 Google reviews
The real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…
· 7 min read
Automated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …
· 5 min read
The question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …
· 6 min read
In Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…
· 6 min read
Without documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…
· 6 min read
The risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…
· 5 min read
Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…
· 7 min read
A locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…
· 5 min read
A cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…
· 6 min readNumbers you can verify
Partners and certifications
DataRoad · Managed IT for business
Technology that works quietly, so your team works without interruptions. Engineering precision in every request.
We do IT right.
IT Unlimited reduces risk and shows in writing what changed.
