Turning On MFA by Friday at a 700-User Freight Company
Vantage Freight has 700 users on Microsoft 365 E3 and no Conditional Access policies. In March, a password spray from a foreign IP range compromised five accounts without MFA; one mailbox carried a hidden forwarding rule to an external address for eleven days before it was noticed. Two constraints complicate the fix: 120 users still run Office 2013 on Windows 7 machines, and the shipping dock runs a twelve-year-old scanner appliance that emails dispatch notes to four internal mailboxes using SMTP basic authentication. Three global administrators share one password, which is stored in a spreadsheet on a file share. The COO has asked for MFA 'for everyone, by Friday'.
1. What breaks if MFA is enforced tenant-wide on Friday, and what sequence should you run instead?
Read the worked answer
Enforce on Friday and you will take down the shipping dock and 120 desktops - then be pressured into a blanket exception that undoes the whole exercise. Sequence it:
- Measure. Turn on a Conditional Access policy in report-only mode and watch sign-in logs for a week. You will see exactly which clients fail modern authentication.
- Fix the desktops. Office 2013 cannot complete modern authentication against Microsoft 365; those 120 users will fail MFA no matter what policy you write. They must move to a supported Office build on a supported Windows version. This is the real project, and it is not an IT policy problem.
- Handle the scanner deliberately (see next task).
- Enforce in rings: IT pilot, then office staff, then the remaining desktops.
- Kill legacy auth with a block-legacy-authentication policy once the report-only data shows only the scanner remains.
MFA enforcement itself only needs Entra ID P1, which E3 already includes - so the blocker here is endpoints, not licensing. Say that out loud to the COO: the deadline is achievable for 580 people and needs a hardware refresh conversation for 120.
2. The scanner cannot do MFA. How do you keep dispatch notes flowing without creating an unmonitored hole?
Read the worked answer
Do not carve the appliance out of Conditional Access by exclusion and walk away - that is how the forwarding-rule incident repeats itself.
Options, worst to best:
- Exclude the device by IP, no compensating control. Fast, invisible, unmonitored. Reject.
- Direct send / SMTP relay through a connector if the notes go to internal mailboxes only and the appliance can be pinned to the office egress IP. Good for the four internal recipients; no licensed account needed at all, which is the cleanest answer.
- SMTP AUTH client submission on a dedicated licensed service account, enabled per-mailbox, then:
- restrict to a named location (the dock's static IP) so the credential is useless anywhere else,
- create a Conditional Access policy that blocks all interactive and legacy sign-ins for that account while permitting only the SMTP path,
- alert on any sign-in from outside that IP and on any new forwarding rule.
Also block SMTP AUTH tenant-wide by default and enable it only for the one account, so the next appliance someone plugs in fails closed rather than silently opening a hole.
3. What should be done about the three shared administrator accounts, given the current licensing?
Read the worked answer
This is arguably a bigger risk than the missing MFA: those three credentials can rewrite every policy you are about to deploy.
Immediate actions:
- One named admin account per administrator. Cloud-only, no licence-consuming mailbox needed for day-to-day work, no shared password. Rotate the current shared password on the day the change lands and review the audit log for its prior use.
- Standing break-glass: keep two cloud-only accounts excluded from Conditional Access with unique long credentials, stored physically, monitored by alert on any sign-in. Excluding them is deliberate and must be documented - an untested exclusion is a back door.
Licensing judgement: Privileged Identity Management and just-in-time role activation are Entra ID P2, not P1, so E3 alone does not deliver them. Options are to license the small admin population with an E5-class or Entra ID P2 licence, or to accept permanent admin roles plus MFA and heavy alerting. For an organisation that just had a mailbox forwarding rule live for eleven days, buying P2 for five administrators costs less than the next incident.