On behalf of a partner, we conducted a detailed audit ofMicrosoft 365 MFA configurations, targeting accounts still using phonenumbers for second-factor verification. These were flagged as a securityrisk due to their vulnerability to SIM swapping and phishing.

The project involved:

• Identification     of all users relying on SMS/phone call MFA
• User-specific     notifications and migration plan for rollout
• Systematic     deployment and enforced setup of Microsoft Authenticator
• Disabling     of legacy MFA methods to prevent fallback risks
• Ongoing     compliance monitoring and support

This proactive change ensured long-term protection for useraccounts, reduced attack surface, and aligned the tenant with modern securitybest practices recommended by Microsoft.

‍