Is MFA Enough? How Credit Unions Should Protect Employee Accounts and Microsoft 365

October is Cybersecurity Awareness Month, and there’s one piece of cybersecurity advice almost every organization has heard:

Turn on multi-factor authentication.

That’s good advice.

But I was talking with a business leader once who asked me:

“Rusty, we have MFA. Doesn’t that pretty much protect us if somebody steals an employee’s password?”

My answer was:

It helps tremendously. But MFA isn’t the finish line.

Think about your credit union’s Microsoft 365 environment.

Employees use Outlook.

They communicate through Teams.

They store documents in SharePoint and OneDrive.

Managers approve requests.

Administrators manage accounts and permissions.

A compromised Microsoft 365 identity can potentially give an attacker something much more valuable than access to an inbox.

It can give them a trusted identity inside your organization.

That’s why Cybersecurity Awareness Month is a good time to look beyond passwords and ask:

How are we protecting the people, accounts, and identities that have access to our credit union’s information?

Here are seven areas I’d review.

1. Start With MFA—But Don’t Stop There

Let’s begin with the obvious one.

If you’re relying on a username and password alone to protect important systems, that’s a conversation worth having immediately.

Multi-factor authentication adds another verification step.

But don’t simply ask:

“Do we have MFA?”

Ask:

“Which accounts have MFA, and are there any exceptions?”

Review:

• Microsoft 365 accounts
• Administrative accounts
• Remote access
• Critical applications
• Vendor accounts
• Cloud services

Exceptions matter.

If 99 employees have MFA but one powerful administrator account doesn’t, that’s the account I’d want to understand.

2. Protect Administrator Accounts Differently

Not every account has the same level of risk.

Think about your credit union.

One employee may have access to email and a handful of applications.

An administrator may have the ability to create accounts, change security settings, reset passwords, or modify access.

Those accounts deserve additional attention.

Ask:

• Who has administrative privileges?
• Do they actually need those privileges?
• Are administrative activities separated from normal daily work where appropriate?
• When were privileged accounts last reviewed?
• Are vendor administrative accounts still necessary?

I like the principle of least privilege.

Give people enough access to do their jobs.

Not more.

The fewer unnecessary keys floating around the building, the better.

3. Don’t Assume Every MFA Method Provides the Same Protection

Here’s where the cybersecurity conversation has evolved.

Attackers evolve too.

Some phishing attempts are designed not only to steal passwords but also to trick people into approving authentication requests or entering information into convincing fake login pages.

That’s why organizations should evaluate the strength of the authentication methods they’re using.

Depending on your environment, stronger options may include phishing-resistant authentication technologies such as passkeys, security keys, or Windows Hello for Business.

That doesn’t mean every credit union should run out tomorrow and change everything.

It means your technology partner should be able to answer:

“Is the way we’re authenticating employees appropriate for the risks we’re trying to manage?”

That’s a much better question than simply checking a box marked “MFA enabled.”

4. Use Context to Make Better Access Decisions

Imagine two login attempts.

The first comes from an employee’s normal company-managed computer during the workday.

The second comes from an unfamiliar device under unusual circumstances.

Should those attempts automatically be treated exactly the same?

Maybe not.

Microsoft Entra can provide Conditional Access capabilities that help organizations make access decisions based on defined conditions and policies.

The technical details belong with your technology and security team.

Leadership needs to understand the business idea:

Access shouldn’t depend only on whether somebody knows a password.

Your organization can evaluate additional signals and require stronger verification when circumstances warrant it.

Security should make it harder for the wrong person to look like the right person.

5. Know What Happens When an Employee Leaves

This sounds simple.

It isn’t always.

Someone leaves the credit union.

Who disables the account?

When?

What happens to email?

What about mobile devices?

Microsoft 365 sessions?

Remote access?

Shared folders?

Third-party applications?

Administrative permissions?

What if the employee had access to a vendor portal that IT didn’t know about?

Employee departures need a repeatable process involving the appropriate departments.

HR, leadership, IT, and other responsible teams should know exactly what happens and when.

The same is true when employees change roles.

A promotion shouldn’t mean someone keeps every permission from their previous job forever.

6. Pay Attention to Vendors and Outside Access

Employees aren’t the only people who may have access to your technology.

Outside vendors may need remote access.

Consultants may receive temporary accounts.

Technology providers may have administrative privileges.

Those relationships may be completely legitimate.

But they still need oversight.

During Cybersecurity Awareness Month, create a list of outside organizations with access to your environment.

Then ask:

Why do they have access?

What can they access?

How is their access protected?

Who reviews it?

Do they still need it?

Temporary access has a funny habit of becoming permanent when nobody goes back and checks.

7. Monitor for Unusual Activity

Good identity security isn’t only about preventing unauthorized access.

It’s also about recognizing when something doesn’t look right.

Maybe there’s an unusual sign-in.

An unexpected administrative change.

Suspicious email activity.

A new forwarding rule.

An account behaving differently from normal.

Your security team should have processes and appropriate technology for monitoring meaningful events and responding when something warrants investigation.

Then leadership should ask:

“If an employee’s Microsoft 365 account were compromised tonight, how quickly would we know?”

That’s a question worth answering.

A Simple Identity Security Framework: LOCK

Cybersecurity gets easier to discuss when people have a simple framework.

For identity security, think LOCK.

L — Limit Access

Give employees, administrators, and vendors only the access they need.

O — Observe Activity

Monitor for meaningful changes and suspicious behavior.

C — Confirm Identity

Use appropriate MFA and stronger authentication methods where the risk warrants them.

K — Kill Unneeded Access

Remove old accounts, unnecessary privileges, outdated vendor access, and permissions people no longer need.

Limit. Observe. Confirm. Kill unnecessary access.

That’s much easier for leadership to remember than a page of Microsoft security acronyms.

Five Questions to Ask Your IT Provider This Month

Cybersecurity Awareness Month gives leadership a good excuse to ask:

1. Are all appropriate Microsoft 365 accounts protected with MFA?

2. Who currently has administrator access?

3. Are there old, unused, shared, or vendor accounts we should review?

4. What would alert us if an employee’s account were compromised?

5. What should we improve over the next 90 days?

You don’t need to understand every Microsoft security setting.

You need to understand whether the risks are being managed.

Final Thoughts

MFA matters.

Use it.

But don’t let an MFA checkbox create a false sense of security.

Protecting identities requires layers.

Strong authentication.

Appropriate access.

Protected administrator accounts.

Thoughtful policies.

Vendor oversight.

Monitoring.

A good onboarding and offboarding process.

And employees who know how to recognize suspicious requests.

During Cybersecurity Awareness Month, don’t ask only:

“Do we have MFA?”

Ask:

“If someone stole one of our employee’s passwords tonight, what else would stand between that attacker and our credit union?”

The answer should be more than one thing.

Because good cybersecurity is rarely one product or one setting.

It’s layers working together.

And when those layers protect the identities your employees use every day, they ultimately protect something even more important:

Your members’ trust.

Is Your Credit Union’s Microsoft 365 Environment Properly Protected?

Cybersecurity Awareness Month is a good time to find out.

At CTG, we help credit unions evaluate the bigger Microsoft 365 security picture—including multi-factor authentication, identity and access management, administrative privileges, Conditional Access, email security, vendor access, employee onboarding and offboarding, monitoring, and cybersecurity strategy.

For more than 26 years, CTG has helped organizations make practical technology decisions, backed by a team with more than 200 years of combined experience.

Our vendor-agnostic approach starts with one question:

What does your organization actually need to reduce risk?

If you’re not sure what would happen if one of your Microsoft 365 accounts were compromised, let’s find out before an attacker does.

Talk with CTG

Phone: 330-655-8144
Email: brett.harney@ctgusa.net
Website: ctgusa.net

This Cybersecurity Awareness Month, let’s go beyond checking the MFA box—and build layers of identity protection around the people and information your credit union depends on.