Microsoft Is Changing Authentication: What Nonprofits Need to Know

Microsoft is changing how users sign in to Microsoft 365, and nonprofit organizations should start preparing.

For nonprofits, Microsoft 365 is often the backbone of daily operations. Email, donor information, financial documents, grant applications, volunteer records and confidential communications are all stored in cloud-based systems.

Microsoft is increasingly encouraging organizations to move away from traditional passwords and older multifactor authentication (MFA) methods toward passkeys and phishing-resistant authentication.

These changes are especially important for nonprofit organizations that operate with limited IT resources, remote staff, volunteers and sensitive donor information.

What Is Microsoft Changing?

For many years, organizations were encouraged to enable MFA to protect their Microsoft 365 accounts.

Traditional authentication often involves entering a password followed by a verification code sent through SMS or an approval through Microsoft Authenticator.

Although these methods provide substantially better protection than passwords alone, modern phishing techniques can sometimes defeat them.

Microsoft is now placing greater emphasis on phishing-resistant authentication methods, including:

• Passkeys stored in Microsoft Authenticator
• FIDO2 hardware security keys
• Windows Hello for Business
• Supported device-bound and synced passkeys
• Certificate-based authentication for suitable environments

What Is a Passkey?

A passkey is a modern authentication method that allows users to sign in without entering a traditional password.

Instead, employees can authenticate using a supported device or security key, often unlocked with:

• Fingerprint recognition
• Facial recognition
• A device PIN
• Microsoft Authenticator
• A physical FIDO2 security key

Passkeys use public-key cryptography. The private key is not sent to Microsoft during authentication, making it much harder for cybercriminals to steal and reuse sign-in credentials.

Why Nonprofit Organizations Should Pay Attention

Nonprofits often face the same cybersecurity threats as larger businesses but may not have dedicated internal cybersecurity personnel.

Many organizations depend on part-time employees, volunteers, contractors and board members who access information from different locations and devices.

A compromised Microsoft 365 account can potentially expose:

• Donor and fundraising records
• Financial and banking information
• Grant applications and reporting documents
• Employee and volunteer information
• Sensitive client or beneficiary information
• SharePoint and OneDrive documents
• Confidential board and executive communications

Attackers may also impersonate trusted employees or executives to request fraudulent payments, redirect donations or distribute phishing emails.

Improving authentication is therefore not simply an IT upgrade. It is part of protecting the organization's reputation, operations and the communities it serves.

Why Traditional MFA Is No Longer Enough

Enabling MFA remains one of the most important security improvements an organization can make. However, not all MFA methods provide equal protection.

Consider a common phishing scenario:

• An employee receives an email that appears to come from Microsoft.
• The email directs the employee to a fake Microsoft 365 login page.
• The employee enters their password.
• The attacker uses the stolen credentials to initiate a genuine sign-in.
• The employee may approve a fraudulent MFA request or enter a verification code.

More sophisticated attacks can use phishing proxies to capture authenticated sessions.

Passkeys help prevent these attacks because authentication is cryptographically associated with the legitimate website.

This is why Microsoft increasingly recommends phishing-resistant MFA, particularly for accounts with access to sensitive information.

Microsoft Authenticator: What Is Different?

Many nonprofit employees already use Microsoft Authenticator to approve sign-in requests.

However, there is an important distinction between traditional Authenticator push notifications and passkeys stored in Microsoft Authenticator.

Traditional Microsoft Authenticator

Typically involves approving a notification or entering a number to complete a sign-in. This provides additional security but remains potentially vulnerable to certain phishing techniques.

Microsoft Authenticator Passkeys

Use cryptographic authentication rather than a reusable password or verification code. Supported passkey authentication provides phishing-resistant protection.

For many nonprofits, enabling passkeys in Microsoft Authenticator may be a practical starting point without requiring every employee to purchase a physical security key.

Should Nonprofits Purchase Physical Security Keys?

Physical FIDO2 security keys provide strong authentication using a dedicated USB or NFC device.

They are especially useful for individuals with privileged access or responsibility for financial and sensitive organizational information.

Nonprofits may want to prioritize physical security keys for:

• Microsoft 365 Global Administrators
• IT administrators
• Executive directors
• Finance and accounting personnel
• Staff handling highly sensitive donor or client information

Security keys do not necessarily need to be deployed to every employee immediately. A risk-based approach can help organizations balance security, usability and cost.

Six Steps Nonprofits Should Take Now

1. Review Existing MFA Methods

Determine how employees, volunteers and administrators currently authenticate to Microsoft 365.

Identify accounts that still rely on passwords and SMS verification, as well as accounts without appropriate MFA protection.

2. Protect Administrator Accounts First

Administrator accounts have elevated privileges and should receive stronger protection.

Consider phishing-resistant authentication through supported passkeys, Windows Hello for Business or FIDO2 security keys.

3. Introduce Passkeys Gradually

Start with a small group of employees before expanding across the organization.

This gives IT personnel time to validate device compatibility, enrollment procedures and user experience.

4. Establish Account Recovery Procedures

Organizations need a documented process for employees who lose a phone, replace a laptop or lose access to a security key.

Microsoft Entra Temporary Access Pass can help with passwordless enrollment and recovery when configured appropriately.

5. Review Conditional Access Policies

Organizations with the appropriate Microsoft Entra licensing can use Conditional Access to strengthen authentication based on user privileges, device security, application sensitivity and other risk factors.

For example, privileged administrators can be required to use phishing-resistant authentication.

6. Review Overall Microsoft 365 Security

Authentication is only one part of cybersecurity.

Nonprofits should also review email protection, endpoint security, backup procedures, account permissions, external sharing and security monitoring.

Do Nonprofits Need Additional Microsoft Licenses?

Microsoft Entra ID supports passkey authentication without requiring an additional license solely to use the authentication method.

However, additional capabilities such as Conditional Access, advanced identity risk detection and automated security policies may require specific Microsoft Entra or Microsoft 365 licensing.

Many eligible nonprofit organizations can access Microsoft products through nonprofit grant and discount programs.

Before purchasing additional licenses, organizations should review their existing Microsoft 365 subscriptions and determine which security capabilities they already have.

The Goal Is No Longer Simply to Enable MFA

A few years ago, one of the most common cybersecurity recommendations was simply to enable multifactor authentication for every employee.

That advice remains important, but authentication security continues to evolve.

For nonprofits, adopting passkeys does not need to be complicated or expensive.

A properly planned transition can improve account security while reducing employees' dependence on passwords and verification codes.

How TEKYHOST Helps Ontario Nonprofits

TEKYHOST provides managed IT services and cybersecurity solutions for nonprofit organizations across Ontario.

Our team can assist with reviewing Microsoft 365 security settings and developing an authentication strategy appropriate for your organization's size, existing technology and budget.

Our services include:

• Microsoft 365 security assessments
• MFA and passkey deployment planning
• Microsoft Authenticator configuration
• FIDO2 hardware security key implementation
• Microsoft Entra Conditional Access configuration
• Administrator account protection
• Microsoft 365 security monitoring
• Employee onboarding and offboarding
• Managed IT support and cybersecurity

Whether your organization has five employees or several hundred, having the right authentication policies in place can significantly reduce security risks.