Enhanced MFA Enforcement Policy: Strengthening ExchangeDefender Security Measures | ExchangeDefender [ Skip to content ](#main) [ ![ExchangeDefender](/assets/images/xd_logo_blue.png) ](/) Email Security ![Platform Overview](/assets/images/m-xd-pro.png)### ExchangeDefender PRO Enterprise-grade email security made simple for every business. [Sign Up](/sign-up) [Live Demo](/demo) [Email Security Stops spam, malware & phishing in real time. ](/email-security) [Encryption Secure your emails, attachments & sensitive data. ](/corporate-email-encryption) [Web File Sharing Easy, safe cloud file sharing with access control. ](/web-file-server) [Live Archive Locked-in email backup & continuity during outages. ](/livearchive-backup) [Emergency Inbox Keep email flowing without interruption if your provider fails. ](/inbox) [Spearphish Train your team with phishing simulations & risk tracking. ](/spearphishing) Managed Email ### Enterprise-Grade Managed Email Reliable, secure, and fully managed email operations for modern organizations. ![ExchangeDefender](/assets/images/managed_email_menu.png) [Microsoft365/Google Email Management Expert management and security for Microsoft 365 and Google Workspace email. ](/managed-email-operations) [AI Advisory Secure, practical AI consulting & implementation for SMBs. ](/management-ai) Company ### ExchangeDefender: 29+ Years of Trust We are a cybersecurity company focused on business email protection, with 29+ years of experience keeping organizations secure, connected, and resilient. ![ExchangeDefender](/assets/images/careers_1.png) [ About Us Learn our purpose, values, and the mission behind every decision. ](/about-us) [ Blog News, product updates and email security insights. ](/blog) [ Capabilities Discover the tech and expertise that keep your email secure around the clock ](/capabilities) [ Careers Be part of a team using modern tech to solve real threats and ship great work. ](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human Open menu Menu ---- Email Security [Email Security](/email-security) [Encryption](/corporate-email-encryption) [Web File Sharing](/web-file-server) [Live Archive](/livearchive-backup) [Inbox](/inbox) [Spearphish](/spearphishing) Managed Email [Microsoft365/Google Email Management](/managed-email-operations) [AI Advisory](/management-ai) Company [About Us](/about-us) [Blog](/blog) [Capabilities](/capabilities) [Careers](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human February 20, 2024 · [General](https://www-preview.exchangedefender.com/blog?category=uncategorized) Enhanced MFA Enforcement Policy: Strengthening ExchangeDefender Security Measures ================================================================================= [![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2024/02/YT-Thumbnails-13-1024x576.png)](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2024/02/YT-Thumbnails-13.png) For years,[ ExchangeDefender](http://www.exchangedefender.com) users have enjoyed enhanced login security via multi-factor authentication security (aka MFA, 2FA, OTP). In our March feature update, we hope to improve your security and enhance MFA enrollment to keep you and your data safe. Allow us to introduce to you the new MFA Enforcement Policy! **Note from the boss**: Before we get to any discussion of policies, our official recommendation is to enforce MFA on every service we provide and to rotate passwords **at least** once a quarter. I know, nobody likes the second validation prompt but this is a standard in the industry and I can't think of a bank or a vendor that doesn't require it. Maybe I'm jaded because we're a cybersecurity company.. and with all the layers of MFA/VPN/auth we have in place I spend an insane amount of time trying to find my key or wait for the new pin to display in my authentication app. Because when I interact with a vendor that holds my information and they have no login security.. all I can wonder is what else they're not doing to keep my data safe? Is this a real business or some Wordpress plugin? At the same time, I understand we have a ton of customers in SMB space where sometimes (obnoxious) tech can be slow and difficult to implement. But you pay us to keep you safe - and to keep your backups safe, and to keep your business continuity safe, and to do that we absolutely must require MFA. But we also can't expect staff who have clicked on a Release/Trust link for over a decade to be cool with suddenly being forced into MFA enforcement workflow on Monday. So we designed a compromise. I hope it fits your organization and I hope you adopt it as fast as possible. Sincerely, -**Vlad Mazek**, CEO Own Web Now Corp. **In March 2024** you will have the ability to enforce or require MFA enrollment at the domain level. What this means is that you'll be able to require MFA enrollment with an authenticator app for everyone with just one click at **[https://admin.exchangedefender.com](https://admin.exchangedefender.com/):** [![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2024/02/image1-1024x425.png)](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2024/02/image1.png) With this policy, you can secure your users' login with multi-factor authentication without making them enroll a device. ### How does it work? When your users go to [admin.exchangedefender.com](http://admin.exchangedefender.com/) and attempt to access Inbox, WFS, or LiveArchive we will check their MFA enrollment and if none is found we'll just tell them we have to verify their identity: [![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2024/02/image2-803x1024.png)](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2024/02/image2.png) When they check their mailbox they'll see an email from ExchangeDefender and just provide the code back. [![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2024/02/image3-1024x928.png)](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2024/02/image3.png) This way your ExchangeDefender login is technically secured at ExchangeDefender with MFA even if you haven't enrolled a device in MFA yet. There is no way to get into the secure areas of your account without enrolling into MFA. *But what if someone guessed the password, they can just enroll a device and hijack the account, right? **No.*** When you set MFA Enforcement to Required/Forced, all your users are automatically set into an MFA mode that relies on their email address for secondary verification. When they visit [admin.exchangedefender.com](http://admin.exchangedefender.com/) for the first time and provide their username and password the system will check their MFA enrollment and if email MFA is detected the system will send them an email with a verification code to proceed. This way we're using the email MFA as a way to verify their identity and then we enroll their authenticator app as usual by scanning the QR code. ExchangeDefender Quarantine Reports behavior will not change at all as a result of the change in the MFA Enforcement policy. ExchangeDefender Quarantine Reports do not rely on the login system at all as the user is never prompted to authenticate to trigger the release of the message. Instead, quarantine operations are tokenized and one "release" request does not automatically grant any other release or trust requests with the same token. It also doesn't automatically log them into ExchangeDefender so there is no getting by the MFA! ### Secure your logins now It's 2024 and the world has changed when it comes to authentication and identity when dealing with services online. Experiencing a cybersecurity threat or compromise is an incredibly expensive and frustrating experience that can easily be avoided by requiring an ID check before granting access to sensitive information. ExchangeDefender MFA Enforcement Policy is your way to protecting your organization from unauthorized and unverified access. [ Previous post Improved SPAM Release Security: Quick Release February 16, 2024 ](https://www-preview.exchangedefender.com/blog/2024/02/improved-spam-release-security-quick-release) [ Next post Enhanced Security: ExchangeDefender Now Supports Custom Authenticator Apps for MFA! February 23, 2024 ](https://www-preview.exchangedefender.com/blog/2024/02/enhanced-security-exchangedefender-now-supports-custom-authenticator-apps-for-mfa) Related Posts ------------- [ 1 May ](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live)### [ExchangeDefender New UI is Live](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live) [Read more: ExchangeDefender New UI is Live](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live) [ ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2026/04/xd10.png) 2 Apr ](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10)### [Announcing ExchangeDefender 10](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10) [Read more: Announcing ExchangeDefender 10](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10) [ ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2025/12/christmas-1.jpg) 25 Dec ](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas)### [Merry Christmas](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas) [Read more: Merry Christmas](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas) Search the blog Search Recent Posts ------------ - [ExchangeDefender New UI is Live](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live) - [Announcing ExchangeDefender 10](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10) - [Merry Christmas](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas) - [Why IoT Devices Are a Hidden Security Risk for Your Business](https://www-preview.exchangedefender.com/blog/2025/11/why-iot-devices-are-a-hidden-security-risk-for-your-business) - [Top 5 IT Problems Small Businesses Face in 2025 — and How to Fix Them](https://www-preview.exchangedefender.com/blog/2025/10/top-5-it-problems-small-businesses-face-in-2025-and-how-to-fix-them) Categories ---------- - [Archiving](https://www-preview.exchangedefender.com/blog?category=archiving) (21) - [Business Continuity](https://www-preview.exchangedefender.com/blog?category=business-continuity) (13) - [Compliance](https://www-preview.exchangedefender.com/blog?category=compliance) (8) - [ExchangeDefender](https://www-preview.exchangedefender.com/blog?category=exchangedefender) (349) - [General](https://www-preview.exchangedefender.com/blog?category=uncategorized) (590) - [Hosted Services](https://www-preview.exchangedefender.com/blog?category=hosted-services) (86) - [Industry News](https://www-preview.exchangedefender.com/blog?category=industrynews) (29) - [Marketing](https://www-preview.exchangedefender.com/blog?category=marketing) (18) - [Phishing](https://www-preview.exchangedefender.com/blog?category=phishing) (5) - [PRO TIPS](https://www-preview.exchangedefender.com/blog?category=pro-tips) (44) - [Product Features](https://www-preview.exchangedefender.com/blog?category=product-features) (54) - [Security](https://www-preview.exchangedefender.com/blog?category=security) (65) - [Shockey Monkey](https://www-preview.exchangedefender.com/blog?category=shockey-monkey) (22) - [Spamfilter](https://www-preview.exchangedefender.com/blog?category=spamfilter) (5) - [Support](https://www-preview.exchangedefender.com/blog?category=support) (45) - [Webinars](https://www-preview.exchangedefender.com/blog?category=webinars) (44) Solutions --------- - [Stop Spam & Malware](/email-security) - [Hands-Free Email Backup](/livearchive-backup) - [Instant Email Recovery](/inbox) - [Send Private Emails](/corporate-email-encryption) - [Train Against Email Threats](/spearphishing) - [Share Files Safely](/web-file-server) Company ------- - [About ExchangeDefender](/about-us) - [Compliance & Legal](/our-compliance) - [Become a Partner](/partners) - [Support Portal Login](https://support.exchangedefender.com/) - [Microsoft 365 Email Management](/managed-email-operations) - [AI Advisory Service](/management-ai) ![ExchangeDefender](/assets/images/dark-xd-logo.png)USA: +1 (407) 465-6800 United Kingdom: 0800 8620149 Australia: +61 0390010641 Fax: +1 (954) 839-8737 [ ](https://www.facebook.com/ExchangeDefender) [ ](https://www.twitter.com/XD_Defender) [ ](https://www.linkedin.com/company/exchangdefender) [ ](/blog) © 2026 Own Web Now Corp - All rights reserved </> with ❤️ in Orlando [SLA](/sla) [TOS](/tos) [PRIVACY](/privacy-end-users) [AUP](/aup) We're Here to Help 👋 -------------------- Tired of AI 🤖 and hold music? Request a call or text (sms/telco charges may apply) and someone with a brain and a pulse will get in touch with you promptly. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Human Contact Submitting... Close Start Your Free Year -------------------- Enter your details and we will set up your free year of email protection. Close modal Website Full Name Email Continue Submitting... Close Try ExchangeDefender for Free 💰 ------------------------------- We look forward to helping you secure your email. We offer a free 30-day no-risk trial, just fill out the form below and one of our onboarding techs will get you started. If you'd just like to take a look at the demo, click here for a [live demo site](/demo). Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney 💰 Get your free month Submitting... 🏃 Explore a Live Demo Submitting... Close Train Your Team Before the Hackers Do 👋 --------------------------------------- ExchangeDefender Spearphish is our new phishing simulation and training tool, designed to help your team spot scams before they click. Want to be first in line? Request early access or get a personal demo — just drop your name and email below. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Early Access Submitting... Close