How to Set Up Multi-Factor Authentication for Your Business
Multi-factor authentication (MFA) is the most effective single step a small business can take against account takeover. Here’s how to roll it out in an afternoon without a flood of locked-out employees.
Pick the right method
From strongest to weakest:
| Method | How it works | Notes |
|---|---|---|
| Passkeys or hardware security keys | A device-bound credential, or a physical key you tap | Strongest, and resistant to phishing. Good for admins and finance staff. |
| Authenticator app with number matching | Approve a login by typing a number shown on screen into an app (Microsoft Authenticator, Google Authenticator, etc.) | Strong, free, and the best default for most staff. |
| Authenticator app codes | Type a six-digit code from an app | Good, though a convincing phishing page can still capture the code. |
| Text message or phone call | A code sent by SMS or voice | Better than nothing, but vulnerable to SIM swapping. Use only as a fallback. |
For most small businesses: authenticator apps for everyone, and passkeys or security keys for administrators and anyone who approves payments.
Step 1: Make a list of what to protect
Start with the systems where a stolen password would hurt most:
- Email (Microsoft 365 or Google Workspace)
- Online banking and payment platforms
- Payroll and HR
- Accounting software
- Remote access (VPN, remote desktop tools)
- Your domain registrar and website host
- Industry systems (EHR, practice management, tax software, TMS)
- Social media accounts
Step 2: Protect admin accounts first
Turn on MFA for every administrator account before anyone else. Create a separate “break-glass” emergency admin account with a long, unique password and a hardware key, stored securely, so you can’t be locked out of your own tenant.
Step 3: Turn it on for email
Microsoft 365
- Business Basic or Standard: turn on security defaults in the Microsoft Entra admin center (Identity → Overview → Properties → Manage security defaults). Security defaults require users to register for MFA and block older sign-in methods that can’t use it.
- Business Premium: use Conditional Access policies instead, which give you more control (for example, requiring MFA from outside the office or only allowing managed devices). Turn off security defaults when you switch to Conditional Access.
Microsoft changes admin center menus fairly often. If a path above doesn’t match, search the admin center for “security defaults” or “Conditional Access.”
Google Workspace
In the Google Admin console, go to Security → Authentication → 2-step verification. Allow users to turn it on, give them an enrollment period, then enforce it.
Step 4: Communicate and schedule
- Tell staff what’s happening, why, and when, a few days in advance.
- Pick a time when someone is available to help. Monday morning before a deadline is a bad choice.
- Send short instructions with screenshots for installing the authenticator app.
- Give users a short enrollment window, then enforce.
Step 5: Plan for lost phones
Before you enforce MFA, decide how people get back in if they lose or replace a phone:
- Admins can reset MFA registration for a user in Microsoft 365 or Google Workspace.
- Have users register a second method where possible.
- Verify identity before resetting anyone’s MFA. “I lost my phone” is a classic social-engineering line.
Step 6: Cover everything else
Work through the rest of your list. Most banks, payroll providers, and SaaS apps support authenticator apps. Where a business app supports single sign-on with Microsoft or Google, connecting it means your email MFA protects it too.
Watch out for MFA fatigue
Attackers who have a password sometimes trigger repeated MFA prompts, hoping someone taps “approve” to make them stop. Number matching (now standard in Microsoft Authenticator) makes this much harder. Teach staff: never approve a sign-in you didn’t start, and report unexpected prompts. They mean someone has your password, which should be changed right away.
Questions about this guide, or something we got wrong? Email [email protected].