MFA Hardening for Practices: Google Workspace and Microsoft 365

Multifactor authentication (MFA) is one of the first controls cyber insurers and security questionnaires ask about. For practices on Google Workspace or Microsoft 365, MFA is on is not enough. You need coverage on the right accounts, fewer exceptions, and evidence you can show without sharing PHI.

This page holds two short hardening sections plus a shared evidence note. Built for practice admins (5 to 100 staff), not enterprise identity teams.

Harborline includes MFA coverage checks in flat-fee risk assessment work (fixed fee, scoped on a short call) and keeps evidence current on the Annual Security Program. Your MSP or internal IT usually implements the clicks. We prioritize and verify.

1. 1Cover email and admin portals first. Then EHR, VPN, and remote desktop with the same discipline.
2. 2No shared front-desk passwords for mailboxes that touch patient communication.
3. 3Separate admin accounts from daily clinical or front-desk use.
4. 4Offboard quickly when staff leave. MFA does not help if the account still exists.
5. 5Prefer phishing-resistant methods where practical (for example, authenticator apps or hardware keys over SMS when your platform and staff can support them).
6. 6Document exceptions with an owner and a review date. Silent exceptions become renewal surprises.

What good looks like

1. 1MFA registered for all users who access Exchange Online and Microsoft 365 email
2. 2Security defaults on, or Conditional Access policies that require MFA for all users (pick one coherent approach, do not leave both half-configured)
3. 3Privileged roles limited, with break-glass accounts documented and monitored
4. 4Legacy authentication blocked where your EHR and scanners allow it (confirm with IT before flipping switches on production day)
5. 5Self-service password reset configured so helpdesk workarounds do not become permanent MFA bypasses
6. 6Sign-in logs or registration campaign report saved as evidence (no PHI)

Quick admin questions for your IT provider

1. 1Are we on Security Defaults or Conditional Access, and is MFA actually required for every interactive sign-in?
2. 2Is legacy auth still enabled for a forgotten printer or old device?
3. 3Who holds Global Administrator, and are those accounts used for daily email?
4. 4Can we export MFA registration status for renewal without exposing patient data?

1. 1We map MFA questions on insurance and payer forms to controls you can show
2. 2We put gaps on a prioritized plan with your IT team or MSP
3. 3We do not replace your MSP, and we do not sell free assessments