Protect these accounts first
- Admin accounts for Microsoft 365 or Google Workspace.
- Everyone’s email. Email is how most other passwords get reset.
- Banking and payroll.
- Your domain registrar and website host.
- Cloud storage and the business apps your team uses every day.
- Remote access to the office, if you have it.
Which kind of MFA
- Authenticator app prompts (Microsoft Authenticator, Google, Duo) are the practical default. Turn on number matching where it is offered.
- Security keys and passkeys are the strongest option because they cannot be phished. They are worth it for admin accounts.
- Text message codes are better than nothing, but can be intercepted by SIM-swap fraud. Use them only where nothing else is offered.
Rolling it out without locking people out
- Pick a day, tell the team in advance, and be available to help.
- Have everyone register two methods, such as an app and a backup phone number or key.
- Store backup codes in a password manager, not on a sticky note.
- Keep one emergency admin account with a long password and a security key, stored safely, in case the main admin is locked out.
- Decide what happens when someone loses or replaces their phone.
Turning it on in Microsoft 365
Microsoft 365 includes security defaults, which require MFA for everyone at no extra cost. Offices that need finer rules, such as not prompting on trusted office computers, can use Conditional Access, which needs a Microsoft Entra ID P1 license (included in Microsoft 365 Business Premium).
Microsoft 365 setup and support
Pair it with a password manager
MFA works best with unique passwords. A password manager gives each person one place for their logins and lets the office share accounts, such as the printer portal or a supplier login, without passing passwords around in email.
Cybersecurity for small offices