Microsoft has already started gradually enforcing MS 365 MFA worldwide for the Microsoft 365 cloud environment from 15 October 2024. All students will be required to do MS 365 MFA by January 2025. Staff will be required to do Multi-Factor Authentication (MFA) by March 2025 after which Microsoft will enforce this security measure for all NWU staff accounts.

This change is part of the Secure Future Initiative, which aims to strengthen security and prevent data breaches.

MFA is a security method commonly required among cloud service providers and requires users to provide two or more pieces of evidence to verify your NWU MS 365 account. It adds an extra layer of protection to the standard username and password authentication.

Currently the NWU user community only use a password to authenticate to access the MS 365 environment and it leaves an insecure vector for attack. If the password is weak or has been exposed elsewhere, an attacker could be using it to gain access. When you require a second form of authentication, security is increased because this additional factor isn't something that's easy for an attacker to obtain or duplicate.

The main purpose of using MS MFA is to reduce the risk of compromising your NWU Microsoft account and strengthen the security of data saved online.

Microsoft has already started gradually enforcing MS 365 MFA in the worldwide Microsoft environment from 15 October 2024. All students will be required to do MS 365 MFA by January 2025. Staff can still opt-in to Multi-Factor Authentication (MFA) until early 2025 after which Microsoft will enforce this security measure for all NWU staff accounts.

These are the additional verification methods to setup:

• Microsoft Authenticator app.
• SMS (Phone).

Methods that can be used to setup Microsoft 365 MFA.

Follow these steps.

• Sign into the Microsoft 365 portal (office.com).
• Select your avatar in the top right, then select View account.
• Select Security info from the left navigation pane to see the account’s security information.

1. MFA provides added security for your accounts. MFA requires additional validation of login credentials, so even if cybercriminals manage to access a user’s password, they’ll still need to confirm their identity in various ways.
2. Mitigates the risk of unmanaged devices when working remotely. With MFA, organisations reduce exposure from compromised personal devices and less secure connections.
3. Enables other security measures to work effectively and can help identify unauthorised access attempts via unexpected authentication prompts.
4. Increases employee productivity and flexibility by reducing password-reset friction and enabling secure remote access.
5. Assists with compliance (e.g., POPIA) by strengthening authentication for sensitive data and online documents.