Another factor
MFA combines different kinds of evidence: something you know, such as a password, with something you have, such as an enrolled authenticator or security key. Two passwords do not make two factors.
About multi-factor authentication
Your business deserves
more than a password.
Protect the account that connects your business mail, sensitive files, calendars and team. MFA adds another check before someone can sign in.
2FA is required on every GridOnBoard account. New accounts have 7 days to set it up.
Why it matters
A stolen password can open too many doors.
Business accounts can expose financial records, customer details, employee information and conversations. An attacker may also impersonate a colleague or send fraudulent payment instructions.
A check against stolen credentials
If a password is leaked or reused elsewhere, the attacker still needs the additional factor. MFA makes password theft less likely to become account access.
Protection for the whole team
A single compromised mailbox can affect colleagues and customers. The announced requirement covers business users, agency users and staff, alongside each account’s existing permissions.
What the research found
A substantial reduction in account compromise.
A May 2023 Microsoft Research study estimated the effect of MFA using commercial Azure Active Directory account data, statistical estimation and manual account review.
99.22%
Estimated relative reduction in account-compromise risk across the study’s population, compared with accounts without MFA.
98.56%
Estimated relative reduction in account-compromise risk among accounts with leaked credentials.
Context matters
These are results from that study, not GridOnBoard measurements, a guarantee for an individual account or the percentage of every kind of cyberattack that MFA prevents.
Microsoft Research · May 2023 study
Relative risk reduction compares the risk between groups. It is not an absolute percentage-point reduction and does not mean risk becomes zero. Outcomes depend on the factor used, how it is deployed, recovery controls and attacker behavior.
Choose stronger protection
All MFA methods are not equally resistant.
Phishing-resistant methods, such as appropriately configured FIDO security keys and passkeys, help resist fake sign-in pages. Authenticator codes improve on a password alone but can still be phished. CISA recommends moving toward phishing-resistant MFA.
CISA · Require multifactor authentication
These examples explain authentication methods. They are not a claim that GridOnBoard currently supports every method listed.
MFA cannot remove every risk.
Malware, stolen session tokens and social engineering of account recovery can still lead to compromise. Microsoft’s incident-response guidance describes attackers stealing sign-in tokens or manipulating recovery to get access.
Microsoft Incident Response · Identity compromise
Keep devices updated, use unique passwords, review who has access and report suspicious activity. MFA works alongside permissions, monitoring and recovery controls; it does not replace them.
GridOnBoard account update
Set up your authenticator.
The signup email code confirms your email address. It does not replace the separate MFA requirement for account access.
- Use the account security flow inside the genuine GridOnBoard console when MFA enrollment is available for your account.
- Keep any recovery material provided during enrollment in a safe place separate from your everyday sign-in device.
- Never give another person your password, authenticator code or recovery material. If you lose access, use the account-support route.
Rollout status. 2FA is now required on every GridOnBoard account. New accounts have 7 days from sign-up to set up an authenticator app; accounts created before the change have until 16 October 2026. After the deadline, business access needs the authenticator code. There are no recovery codes: a lost authenticator is recovered through your business admin or managing agency, and that route is still being qualified.
This is an account-sign-in policy. Service integrations and background jobs use separate restricted machine credentials. They must not be given a human MFA bypass account.
Research and guidance reviewed 15 September 2026. This page explains risk reduction, not an assurance that any account or platform is immune to attack.