Microsoft has been gradually enforcing Multi-Factor Authentication (MFA) across the Microsoft 365 cloud environment worldwide since 15 October 2024. NWU user IDs (@nwu.ac.za, @mynwu.ac.za, and @mysis-nwu.ac.za) will be required to do multi-factor authentication. This initiative aims to enhance cybersecurity by providing an additional layer of protection for Microsoft 365 accounts, helping safeguard users and organizational data against unauthorized access and cyber threats.

This change is part of the Secure Future Initiative, which aims to strengthen security and prevent data breaches.

MFA is a security method commonly required among cloud service providers and requires users to provide two or more pieces of evidence to verify your NWU MS 365 account. It adds an extra layer of protection to the standard username and password authentication.

Currently the NWU user community only use a password to authenticate to access the MS 365 environment and it leaves an insecure vector for attack. If the password is weak or has been exposed elsewhere, an attacker could be using it to gain access. When you require a second form of authentication, security is increased because this additional factor isn't something that's easy for an attacker to obtain or duplicate.

These are the additional verification methods to setup:

• Microsoft Authenticator app.
• SMS (Phone).

Methods that can be used to setup Microsoft 365 MFA.

Follow these steps.

• Sign into the Microsoft 365 portal (office.com) .
• Select your avatar in the top right, then select View account.
• Select Security info from the left navigation pane to see the account’s security information.

1. MFA provides added security for your accounts. MFA requires additional validation of login credentials, so even if cybercriminals manage to access a user’s password, they’ll still need to confirm their identity in various ways.
2. Mitigates the risk of unmanaged devices when working remotely. With MFA, organisations reduce exposure from compromised personal devices and less secure connections.
3. Enables other security measures to work effectively and can help identify unauthorised access attempts via unexpected authentication prompts.
4. Increases employee productivity and flexibility by reducing password-reset friction and enabling secure remote access.
5. Assists with compliance (e.g., POPIA) by strengthening authentication for sensitive data and online documents.