multi factor authentication (MFA)

Rags probably holds the answer to this? There has been an attempt to hack my business email address, which is admin'd by my website host. Its outlook via 365.

Now we have done the usual and changed pass words etc. but I am being told to sign up for MFA which they need to charge £45 + vat set up and £4 + vat per month on-going. I can see that the theory of it is good but is it something I can do myself instead of paying them? unfortunately I have lost faith in them as every time I want a link to a brochure changing or something minor it £60 + vat for this and £60 + vat for that. I suppose its trust rather than faith I have lost. Bear in mind I do pay a monthly hosting fee already.